Business Associate Agreement Checklist for Revenue Cycle Management Outsourcing Firms

Define permitted uses and disclosures of PHI

Specify the revenue cycle management (RCM) services the firm may perform with protected health information (PHI), such as claims submission, eligibility checks, payment posting, denial management, and billing inquiries. Identify which information the firm may access and for which client, purpose, and workflow; avoid broad permissions that could be read to allow unrelated uses.

The HHS guidance on business associate agreements says a business associate agreement (BAA) must establish permitted and required uses and disclosures and restrict other uses or disclosures, subject to limited exceptions. Address any permitted management and administration or data aggregation uses explicitly, along with any required safeguards or assurances.

Build the minimum necessary standard into the scope: define access by role and business task, and limit PHI used or disclosed to what is reasonably needed for the purpose. The standard has exceptions, including disclosures to providers for treatment, so describe workflows accurately rather than treating it as an absolute limit on every use.

Set safeguards and security incident reporting requirements

When the RCM firm creates, receives, maintains, or transmits electronic protected health information (ePHI), require it to comply with applicable HIPAA Security Rule requirements and use appropriate safeguards. The agreement can also specify practical controls—such as access restrictions, authentication, audit logging, workforce training, secure transmission, and backup procedures—tailored to the services and the parties’ risk assessment.

Set a process for reporting security incidents, including who receives notice, how to contact them, what information to include, and how updates and remediation will be handled. The Security Rule requires reporting security incidents the business associate becomes aware of, but it does not prescribe one universal format or level of detail for every incident. Parties can set incident-specific reporting procedures in the BAA, as described in HHS guidance on security incident reporting.

Establish breach response timelines and responsibilities

Separate the reporting process for a suspected security incident from the formal breach notification requirements. HIPAA requires a business associate to notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. That is an outer limit, not a recommended response target; the parties may agree to a shorter deadline. See the HHS Breach Notification Rule guidance.

For suspected incidents that may not ultimately qualify as a reportable breach, set a faster contractual notice target—such as prompt notice within a specified number of hours or days—so the covered entity can assess the event. Assign responsibility for investigation, mitigation, documentation, identifying affected individuals, and preparing information needed for notices to individuals, HHS, or the media when applicable. Make clear which party sends each notice and that the covered entity’s legal responsibilities are not shifted merely by assigning operational tasks to the RCM firm.

Flow down privacy and security obligations to subcontractors

List or define the subcontractors that may handle PHI, such as claims processors, technology providers, and document-management vendors. Require the RCM firm to obtain a written business associate subcontractor agreement before a subcontractor creates, receives, maintains, or transmits PHI on its behalf.

The subcontractor agreement must impose the applicable restrictions and conditions that bind the RCM firm, including relevant HIPAA Security Rule obligations and breach and security-incident reporting requirements. Require the RCM firm to monitor and address subcontractor noncompliance, notify the covered entity of material issues, and end a subcontract where required if reasonable steps to cure the problem fail. HHS explains the requirements for business associates and their subcontractors.

Support patient access amendment and disclosure accounting requests

Set procedures for promptly locating and providing PHI in the RCM firm’s custody when the covered entity needs to respond to a patient’s access request. Specify the format, secure delivery method, point of contact, and turnaround time. HIPAA generally makes the covered entity responsible for responding to the individual, but the BAA must require the business associate to make relevant PHI available as needed.

Require the RCM firm to help the covered entity amend PHI in its designated record set when instructed, and to supply information needed for an accounting of disclosures. Define what disclosure details the RCM firm must retain, how long it must retain them under the applicable agreement and requirements, and how quickly it must provide them. The parties can agree that the RCM firm will handle some patient-facing requests directly, but should state that arrangement clearly.

Set records oversight and audit rights

Require the RCM firm to keep records that help demonstrate compliance with the BAA, such as access logs, incident records, training documentation, and subcontractor agreements, as applicable to its services. Specify how the covered entity can request relevant records, receive status reports, and track corrective actions.

HIPAA requires the business associate to make relevant internal practices, books, and records available to HHS for purposes of determining the covered entity’s compliance. That requirement does not itself create a general customer right to conduct routine audits. If the covered entity wants assessment or audit rights, define their scope, notice, frequency, confidentiality protections, and any alternatives such as independent assessment reports. The HHS sample BAA provisions describe the records obligation and offer language the parties may adapt.

Coordinate termination and data handling with the RCM service agreement

Align the BAA’s termination provisions with the RCM service agreement so either contract ending triggers a clear transition plan. Identify how the firm will return PHI in a usable format, transfer it to a successor vendor if requested, preserve the covered entity’s access during the transition, and securely destroy remaining copies when appropriate. Address backup copies and subcontractor-held PHI, and require confirmation of completed return or destruction.

HIPAA requires the BAA to provide for return or destruction of PHI at termination when feasible. If that is not feasible, the protections must continue and further uses and disclosures must be limited to the purposes that make return or destruction infeasible. HHS explains these requirements in its guidance on PHI retention after services end. Specify any contractual retention, transition, and deletion deadlines without treating a training certificate or the end of the service agreement as a substitute for ongoing protection of retained PHI.

A well-coordinated BAA defines what the RCM firm may do with PHI, sets workable security and incident procedures, and ensures the covered entity can meet its patient-rights and transition responsibilities. Review it alongside the RCM service agreement so the operational terms support the privacy and security obligations.

FAQs

What permitted uses of PHI should an RCM business associate agreement define?

Define the RCM services that require PHI, such as claims processing, eligibility checks, payment posting, and denial management, and limit use and disclosure to those purposes and any other specifically permitted purposes. Include relevant safeguards consistent with the minimum necessary standard and clearly describe any permitted management, administration, or data aggregation uses.

How quickly must an RCM outsourcing firm report a suspected breach?

HIPAA requires notice to the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. HIPAA does not set one universal deadline for reporting every suspected incident that may not qualify as a breach, so the BAA should set a shorter, specific notice target for suspected incidents and require updates as facts emerge.

What obligations must subcontractors handling PHI accept?

Before a subcontractor handles PHI, the RCM firm must obtain a written agreement requiring it to accept the applicable privacy and security restrictions and conditions that apply to the RCM firm. The agreement should address permitted uses, safeguards, incident and breach reporting, patient-rights support where relevant, and handling PHI when the subcontract ends.

What should happen to PHI when the agreement ends?

The BAA should require the RCM firm to return or destroy PHI when feasible and address PHI held by subcontractors, copies, backups, and transition to the covered entity or a successor vendor. If return or destruction is infeasible, the BAA’s protections must continue and further uses and disclosures must be limited to the purposes that make return or destruction infeasible.