Business Associate Agreement Checklist for Medical Transcription Services

A medical transcription vendor may receive patient details in recordings, draft reports, and completed transcripts. If it handles Protected Health Information (PHI) on behalf of a covered provider or another business associate, a written HIPAA Business Associate Agreement (BAA) is generally required before that work begins. Use this checklist to define the permitted work, safeguards, reporting duties, and end-of-contract handling clearly.

When does a medical transcription service need a BAA?

A medical transcription company generally needs a BAA when it performs transcription or a related service for a covered entity or business associate and, in doing so, creates, receives, maintains, or transmits PHI. HHS specifically identifies an independent medical transcriptionist—or an app vendor providing transcription services to a physician—as a potential business associate. The key question is whether the company handles PHI on behalf of the provider, rather than whether the work is done on paper, through audio files, or in a digital platform. See HHS guidance on business associates.

Before transferring recordings or records, confirm the parties’ roles and sign the BAA. A provider’s workforce member is treated differently from an outside vendor; but an independent company or contractor that handles PHI on the provider’s behalf may be a business associate. A BAA documents the required assurances and responsibilities—it does not, by itself, make an organization compliant with every HIPAA obligation.

• Identify the covered entity or upstream business associate and the transcription company.
• Describe the transcription services and the types of PHI the vendor may handle.
• Confirm the agreement is in place before PHI is disclosed for the service.

Which permitted uses and disclosures should the BAA define?

Specify the work the transcription company is authorized to perform, such as receiving dictated audio, preparing or editing transcripts, returning completed records, and correcting errors when requested. Define how the vendor may receive and return files, which personnel may access them, and whether any other party is allowed to receive PHI.

The agreement should prohibit uses or disclosures outside the contract or as otherwise required by law. If the vendor may use PHI for its proper management and administration or for data aggregation, those permissions should be expressly defined and limited to circumstances HIPAA permits; they are not blanket permission to use patient information for unrelated purposes. The HHS sample BAA provisions describe required terms and optional details the parties may address.

• Define the permitted purpose and scope of transcription work.
• Restrict use and disclosure to what the BAA allows or the law requires.
• Describe how the vendor will report uses or disclosures not permitted by the agreement.
• Set procedures for legal demands and other disclosures required by law.

What safeguards must protect PHI and ePHI?

The BAA should require appropriate safeguards against improper use or disclosure of PHI. When the vendor creates, receives, maintains, or transmits electronic Protected Health Information (ePHI) on behalf of a covered entity or business associate, it must comply with applicable HIPAA Security Rule requirements. The Security Rule calls for appropriate administrative, physical, and technical safeguards to protect ePHI’s confidentiality, integrity, and availability. See HHS’s overview of the Security Rule.

Use the checklist to confirm that the safeguards fit the transcription workflow and the risks involved. Possible contract details include secure file transfer, access limited to authorized personnel, appropriate workstation and device protections, audit logging, backup and recovery processes, and workforce procedures for handling recordings and transcripts. These examples help make responsibilities concrete; the specific safeguards should reflect the organization’s risk analysis rather than be presented as a universal one-size-fits-all list. HHS explains the role of risk analysis in selecting Security Rule safeguards.

Address both audio and text: dictation files, drafts, completed transcripts, temporary copies, and files stored or transmitted electronically can all contain PHI. Clarify how access is controlled and how data is protected during handling, transfer, storage, and disposal.

What incident and breach reporting terms should the checklist include?

Set out how and when the transcription company must report security incidents and impermissible uses or disclosures to the customer. The agreement should cover who receives reports, how to contact them, what initial details are required, and how the parties will coordinate investigation, containment, mitigation, and follow-up. HHS identifies reporting security incidents and breaches of unsecured PHI as BAA requirements; the parties can define practical procedures for handling routine events and unsuccessful attempts. See HHS’s business associate FAQ.

A security incident is not automatically a reportable breach of unsecured PHI. For a breach of unsecured PHI, the business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery under the federal rule. The BAA may set a shorter reporting deadline so the covered entity has time to assess the event and meet its own notification duties. The federal 60-day limit is not a recommended waiting period. See the HHS Breach Notification Rule guidance.

• Require prompt notice of suspected incidents and unauthorized access or disclosure.
• Require breach reports to include available information about affected individuals and the PHI involved.
• Define cooperation for investigation, mitigation, evidence preservation, and required notifications.
• Clarify that any agreed shorter contract deadline does not replace the applicable legal requirements.

How should subcontractors and patient rights be addressed?

If a transcription company uses a subcontractor that will access PHI, the transcription company must have a written agreement with that subcontractor before disclosing PHI to it. The downstream agreement must impose the same applicable restrictions and conditions, including appropriate safeguards for ePHI. These subcontractor flow-down requirements apply to vendors such as transcription personnel, technology providers, or storage services when they handle PHI on the company’s behalf. See HHS guidance on business associate subcontractors.

The BAA should also explain how the vendor will help the covered entity respond to patient requests. Required terms address making PHI available for access, supporting amendments, and providing information needed for an accounting of disclosures when applicable. Define how quickly the vendor must locate and return records, where it should send requests it receives directly, and who communicates with the patient. The covered entity remains responsible for its own Privacy Rule obligations unless it has properly delegated a task under the agreement. See the HHS sample BAA provisions.

What compliance records must be available for review?

The BAA must require the business associate to make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of HHS for purposes of determining the covered entity’s compliance with the Privacy Rule. The agreement should identify a reliable process for providing records and cooperating with inquiries. See HHS’s required BAA provisions.

For day-to-day oversight, the parties may also agree to provide relevant incident records, safeguard documentation, subcontractor agreements, or other evidence on request. Specify the scope, notice, and process for any customer review or audit rights the parties choose to include. Do not treat a general right for a customer to audit the vendor as a universal HIPAA BAA requirement; distinguish it from the required availability of records to HHS.

What happens to PHI when the agreement ends?

The BAA must require the transcription company, if feasible, to return or destroy PHI received from or created on behalf of the covered entity when the agreement ends. Address recordings, transcripts, drafts, backups, and copies held by subcontractors, and describe how return or destruction will be confirmed. HHS explains that the HIPAA Rules generally do not require a business associate to retain ePHI after it finishes providing services, though another applicable law may require retention in a particular case. See HHS guidance on ePHI after services end.

If returning or destroying particular PHI is infeasible, the agreement must provide that the BAA’s protections continue and that further uses and disclosures are limited to the purposes that make return or destruction infeasible. Document what information is affected, why it cannot be returned or destroyed, who can access it, and how it will be safeguarded until it can be disposed of appropriately.

FAQs.

Must a medical transcription service sign a BAA before handling PHI?

Generally, yes, when the service is a business associate handling PHI on behalf of a covered entity or another business associate. The written agreement should be in place before PHI is disclosed for that work. HHS specifically identifies independent medical transcription services as an example of a business associate relationship in appropriate circumstances. See HHS’s business associate FAQ.

What incidents must a transcription business associate report?

The BAA should require reporting of security incidents and uses or disclosures not permitted by the agreement. A breach of unsecured PHI must be reported to the covered entity without unreasonable delay and no later than 60 calendar days after discovery; the BAA may require earlier notice. Not every security incident is necessarily a breach requiring individual notification. See HHS’s breach notification guidance.

Do transcription subcontractors need written BAAs?

Yes, when a subcontractor will access PHI to perform work for the transcription business associate. The business associate must obtain a written agreement imposing the applicable same restrictions and conditions before it discloses PHI to that subcontractor. See HHS guidance on business associate subcontractors.

What must happen to PHI when a BAA terminates?

If feasible, the business associate must return or destroy the PHI. If that is infeasible, the BAA’s protections must continue to apply, and further uses and disclosures must be limited to the purposes that make return or destruction infeasible. Together, these checklist items help you define authorized transcription work, protect PHI and ePHI, coordinate incident response and patient-rights support, manage subcontractors, and close out records securely.