Business Associate Agreement Checklist for Verifying Organizational Credentials

A business associate agreement checklist should cover more than the contract itself. Before your organization allows a vendor or partner to access protected health information (PHI), verify its identity, relevant credentials, security practices, personnel controls, subcontractors, and ability to return or protect data when the relationship ends.

Use this checklist to guide due diligence and document what you reviewed. HIPAA sets specific requirements for business associate relationships, but it does not make every item below—such as a particular insurance limit or a security certification—a universal federal requirement.

How do you verify an organization’s identity, licenses, and exclusion status?

Confirm that the organization you are evaluating is the same legal entity that will sign the agreement, provide the services, and handle PHI. Compare its legal name, any trade names, business address, and responsible signatory with its formation or registration records. The SBA state registration lookup can direct you to the relevant state registration office.

Identify which licenses and permits the organization needs for the specific services and locations involved. Where a service depends on licensed professionals, verify each relevant license directly with the issuing state board or agency. For state professional licensure verification, check the license holder’s name, license number, status, expiration date, and any public restrictions or disciplinary information available from the official regulator.

Consider HIPAA exclusion screening as part of risk-based credentialing, especially when the work intersects with federal health care programs or contract requirements. Search the OIG List of Excluded Individuals and Entities for relevant people and organizations, and keep a record of the search and date. OIG describes the LEIE as a tool for checking exclusion status; a search should not be treated as proof of licensure or as a blanket HIPAA requirement for every vendor.

What insurance, business history, and conflict-of-interest evidence should you review?

Request a current certificate of insurance and, when appropriate, relevant policy details. Depending on the services and potential exposure, you may review professional liability, cyber liability, commercial general liability, and workers’ compensation coverage. Confirm that coverage is active, that limits are suitable for your risk tolerance, and that the named insured matches the contracting entity. HIPAA does not prescribe a universal insurance type or minimum limit for business associates.

Assess business history using references, service records, and information about material regulatory actions, litigation, or security incidents relevant to the engagement. Ask how the organization remediated prior problems, and whether any unresolved issue could affect its ability to safeguard PHI or continue service.

Request disclosure of ownership, key decision-makers, and relationships that could create an actual or perceived conflict of interest. Document identified conflicts and agree on practical controls, such as disclosure, reassignment, independent review, or restrictions on access. Treat these as procurement safeguards tailored to the engagement, not as HIPAA-mandated forms.

Which HIPAA compliance documents should you request?

Ask for documents that show how the organization will meet its obligations for the specific PHI and services involved. A useful review may include:

• The proposed business associate agreement and any applicable service or security addenda.
• A summary of the organization’s privacy and security policies, incident-response procedures, and privacy and security training approach.
• A current HIPAA security risk analysis summary and evidence that identified risks are being managed. HHS explains that regulated organizations must assess risks and vulnerabilities to ePHI; the rule does not prescribe one required assessment format. See HHS guidance on risk analysis.
• Relevant audit or assurance reports, such as a SOC report, if appropriate to the service. Review their scope, date, exceptions, and whether they cover the systems and locations that will handle your data.
• Evidence of required security documentation and review processes, such as policies, risk-management actions, and contingency planning.

Use certifications and third-party reports as supporting evidence, not as a substitute for assessing the vendor’s actual practices. HIPAA does not provide an official organizational “HIPAA certification” that, by itself, establishes compliance. HHS states that required Security Rule documentation must generally be retained for six years from its creation or last effective date; see the HHS summary of the Security Rule.

How do you determine whether the organization is a business associate?

Focus on what the organization does and how PHI is involved—not just the vendor’s job title or contract label. An organization generally is a business associate when it performs certain functions or services for a covered entity, or for another business associate, involving the creation, receipt, maintenance, or transmission of PHI. Examples can include billing, data analysis, claims processing, practice management, and certain technology or administrative services.

Ask whether the organization will create, receive, maintain, or transmit PHI on your behalf, and whether its work involves more than incidental access. A cloud service provider that maintains ePHI may be a business associate even if it cannot decrypt the information. HHS’s business associate guidance and FAQs explain the definition and relevant examples.

Some disclosures do not create a business associate relationship—for example, disclosures to a health care provider for treatment in certain circumstances. Evaluate the actual arrangement against HIPAA’s definitions and exceptions. If the organization is a business associate, put the required written assurances in place rather than relying on a vendor’s assertion that it is “HIPAA compliant.”

What credentials and safeguards should you verify for authorized personnel?

Request a protected health information access roster identifying the roles or individuals who may access your PHI, the purpose of that access, and who approves it. Check relevant professional licenses and qualifications directly with the issuing authority, and ask how the organization updates access when staff change roles or leave.

Verify that workforce members receive role-appropriate privacy and security training, understand the organization’s policies, and are subject to appropriate sanctions for violations. Ask about personnel screening where relevant to the role and risk. HIPAA requires risk-based security safeguards, but it does not impose one universal background-check procedure for every business associate.

Review how the organization limits access to what is needed for assigned duties, authenticates users, monitors access, and promptly removes access when a person no longer needs it. The appropriate safeguards depend on the organization’s circumstances and the risks identified for the PHI and systems involved.

What should the agreement require for subcontractors and incident reporting?

Ask for a list of subcontractors that may create, receive, maintain, or transmit PHI, along with each subcontractor’s role and the data or systems it may access. The agreement should require the business associate to obtain a written subcontractor business associate agreement imposing the applicable restrictions and conditions on that subcontractor. HHS describes these contract requirements in its sample business associate agreement provisions.

Set clear procedures for incident reporting, including who receives notice, how the parties will coordinate, and what information the business associate must provide. The agreement may set a shorter reporting deadline than the federal outer limit so the covered entity has time to assess and meet its own obligations.

For a breach of unsecured PHI, a business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. That is a federal maximum, not a recommended response target. Require prompt initial notice and follow-up details, including available information needed to identify affected individuals. See HHS breach-notification guidance.

How should you assess data handling, remote work, and end-of-contract procedures?

Map how PHI will move through the vendor’s systems, including storage locations, transmission methods, backups, support tools, and any subcontractor environments. Ask what access controls, authentication, logging, encryption, backup, and recovery measures are in place. Assess safeguards in light of the risk analysis; do not assume that one technology or certificate automatically establishes compliance.

For remote work, establish which devices and locations may be used, how access is secured, and how the organization prevents PHI from being stored or viewed in unauthorized settings. Clarify rules for personal devices, printing, local downloads, shared workspaces, and reporting lost equipment. Document any restrictions that your own policies or the service’s risk profile require.

Specify what happens when the agreement ends: when access is revoked, how PHI is returned or securely destroyed, how the business associate will address copies and backups, and what evidence of completion it will provide. HIPAA requires the agreement to provide for return or destruction of PHI when feasible; if that is infeasible, the agreement must extend protections and limit further uses and disclosures. See the HHS guidance on PHI at termination.

In short, verify the organization and people behind the service, review evidence that fits the PHI and the work, and make the agreement specific about access, subcontractors, incident reporting, and data return or destruction. Record your decisions and revisit them when the service, personnel, or risk changes.

FAQs

When is an organization considered a business associate under HIPAA?

An organization generally is a business associate when it performs certain functions or services for a covered entity—or for another business associate—that involve creating, receiving, maintaining, or transmitting PHI. The relationship depends on the actual services and data handling, not simply the contract label. See HHS business associate guidance.

Must a business associate agreement be signed before PHI is disclosed?

A covered entity generally must obtain satisfactory written assurances before permitting a business associate to handle PHI. Put the business associate agreement or other applicable written arrangement in place before disclosing PHI or enabling access, and confirm that it covers the actual services and data involved. HHS outlines the required contract provisions in its business associate contract guidance.

What credentials and compliance records should be checked before signing?

Verify the organization’s legal identity and applicable registrations, licenses, and permits. For relevant personnel, confirm professional credentials with the issuing authority. Review risk-analysis and risk-management evidence, privacy and security policies, training practices, incident procedures, and relevant independent audit reports. These records support due diligence; no single certificate proves organizational HIPAA compliance.

What must a business associate do when the agreement ends?

The agreement must provide for the business associate to return or destroy PHI when feasible. If return or destruction is infeasible, the business associate must continue to protect the retained PHI and limit its further uses and disclosures. Specify access revocation, return format, backup handling, and confirmation of destruction in the agreement. See HHS guidance on termination and retained ePHI.