Business Associate Agreement Checklist for Locum Tenens Staffing Agencies

A locum tenens staffing agency may handle protected health information (PHI) while coordinating assignments, credentialing clinicians, or supporting a healthcare client’s operations. Whether the agency is a HIPAA business associate depends on what information it handles and on whose behalf—not simply on the fact that it supplies clinicians.

Use this checklist to review the agreement’s permitted activities, safeguards, incident procedures, subcontractors, and end-of-contract obligations. A business associate agreement (BAA) should reflect the actual services and information flows between the agency and each client.

When does a locum tenens staffing agency need a BAA?

A staffing agency generally needs a BAA when it creates, receives, maintains, or transmits PHI on behalf of a HIPAA-covered healthcare provider or another business associate while performing services for that organization. For example, the relationship may call for a BAA if the agency handles identifiable patient information to perform a client’s staffing or operational functions.

Do not assume every staffing relationship requires a BAA. Review the data the agency receives, why it receives it, and whether it acts on the client’s behalf. A healthcare provider’s disclosure of PHI to another provider for treatment is treated differently under HIPAA’s business-associate rules. HHS guidance on covered entities and business associates explains when a written business associate contract is required.

Before signing, identify the covered entity or business associate that is the agency’s contracting partner, the services covered, the categories of PHI involved, and which party controls the relevant systems and records. If the agency’s role or data access changes, review whether the BAA still describes the arrangement accurately.

Define permitted uses and disclosures of PHI

List the purposes for which the agency may use or disclose PHI, tying each permission to the services it provides. State that the agency will not use or further disclose PHI except as the BAA permits or as required by law. The BAA must establish permitted and required uses and disclosures and cannot authorize conduct that would violate the Privacy Rule if done by the covered entity. 45 CFR § 164.504 sets out these contract requirements.

Where appropriate to the agency’s work, specify whether PHI may be used for assignment coordination, credentialing, communications with the client, or other named services. Address any disclosures to the client, clinicians, or service providers, and prohibit unrelated uses such as marketing or independent recruitment unless a separate legal basis and written permission allow them.

Build in a practical approach to the minimum necessary standard: limit access and disclosure to what is needed for the permitted purpose when that standard applies. The standard has exceptions, including disclosures to healthcare providers for treatment, so the contract and procedures should account for the actual use. HHS guidance on the minimum necessary requirement explains its general application and exceptions.

Specify administrative, physical, and technical safeguards

Require safeguards appropriate to the PHI and services involved. For electronic PHI, the Security Rule requires a business associate to comply with applicable security requirements and to protect the confidentiality, integrity, and availability of ePHI. 45 CFR § 164.308 describes administrative safeguards, while 45 CFR § 164.314 addresses organizational requirements, including business associate contracts.

• Administrative safeguards: Document risk analysis and risk management, assign security responsibilities, control workforce access, and define policies for training, sanctions, and incident response.
• Physical safeguards: Address how the agency protects devices, workspaces, paper files, and media that may contain PHI.
• Technical safeguards: Describe access controls, authentication, audit or activity review, and protections for electronic information in storage and transmission.

Align contract language with the agency’s actual systems and work practices. Measures such as role-based access, multifactor authentication, encryption, and activity logging can be included where appropriate to the risk and the parties’ agreement; do not present any one measure as a universal HIPAA requirement without checking the applicable rule and circumstances.

Set breach reporting and incident-response procedures

Distinguish a security incident, an impermissible use or disclosure, and a breach of unsecured PHI. Set a clear process for prompt reporting, investigation, containment, mitigation, preservation of relevant records, and cooperation with the client. Specify whom the agency must notify, how to reach them, and what initial facts to provide, such as the affected information, individuals, systems, and response steps.

Federal rules require a business associate to notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. That is an outside limit, not a reason to wait: the BAA may set a shorter reporting deadline so the client has time to investigate and meet its own obligations. 45 CFR § 164.410 states the business associate’s breach-notification requirements.

Include a reporting route for suspected incidents as well as confirmed breaches, and make clear that an initial report does not have to contain every detail. The agency can provide additional information as the investigation progresses. The Security Rule’s contract provisions also require reporting security incidents of which the business associate becomes aware.

Require subcontractor BAAs for PHI handling

Identify which vendors or other subcontractors may create, receive, maintain, or transmit PHI for the agency, such as technology or records-management providers. Before giving a subcontractor access, require a written subcontractor agreement with the same applicable restrictions, conditions, and protections that bind the agency.

The agency remains responsible for managing its subcontractor relationships. Keep an inventory of vendors with PHI access, confirm that each relevant subcontractor agreement is in place, and establish a process to respond to a subcontractor’s material breach or violation. 45 CFR § 164.504 applies the relevant business associate contract requirements to subcontractor arrangements, and 45 CFR § 164.314 addresses subcontractors handling ePHI.

Address termination and PHI return or destruction

Set out how the agency will return or destroy PHI when the BAA or underlying services end, including the process, timing, and confirmation the client can expect. Address copies held by subcontractors and PHI stored in systems, devices, or backups, as applicable to the arrangement.

Under the BAA requirements, the agency must return or destroy PHI at termination if feasible. If return or destruction is infeasible, the BAA must extend its protections to the retained information and limit further uses and disclosures to the purposes that make return or destruction infeasible. 45 CFR § 164.504(e)(2)(J) sets out this requirement. Include secure PHI disposal requirements in the process and document what was returned, destroyed, or retained and why.

Maintain operational controls for BAA compliance

A signed agreement is only one part of compliance. Assign responsibility for managing each BAA, maintain a current inventory of client relationships and subcontractors, and make sure workforce members understand the agency’s policies and the client-specific procedures that apply to their work. Training should reflect job duties and the agency’s and client’s requirements; the BAA checklist alone does not establish a universal federal annual certificate-renewal rule.

Review access when a clinician or staff member starts, changes roles, or leaves; keep records of relevant training, access changes, risk reviews, incidents, and subcontractor agreements. Revisit the BAA when services, systems, vendors, or PHI flows change. These controls help the parties carry out the agreement in practice and address potential gaps before they become incidents.

In short, a locum tenens agency should first determine whether it handles PHI on a client’s behalf, then make sure the BAA clearly limits use and disclosure, requires appropriate safeguards, sets prompt incident reporting, governs subcontractors, and explains PHI return or destruction at termination.

FAQs

When must a locum tenens staffing agency sign a BAA?

When it creates, receives, maintains, or transmits PHI on behalf of a HIPAA-covered entity or business associate as part of its services. The answer depends on the agency’s role and information flows, not simply on whether it supplies clinicians. Disclosures between healthcare providers for treatment are treated differently under HIPAA.

What uses of PHI should a BAA permit?

Only the uses and disclosures needed for the services the agency performs, along with any additional uses permitted by law and expressly described in the agreement. Specify the purposes, recipients, and limits, and apply the minimum necessary standard where it applies.

How quickly must the agency report a suspected PHI breach?

For a breach of unsecured PHI, federal rules require notice to the covered entity without unreasonable delay and no later than 60 calendar days after discovery. A BAA should set a shorter operational deadline for suspected incidents or early reports when feasible, so the client can investigate promptly. The 60-day maximum is not a waiting period.

Do subcontractors handling PHI need equivalent contractual obligations?

Yes. When a subcontractor creates, receives, maintains, or transmits PHI for the agency, the agency must obtain written assurances requiring the subcontractor to follow the applicable restrictions and conditions. For ePHI, the agreement must also address applicable Security Rule requirements.