Business Associate Agreement Requirements for Clinical Data Abstraction Contractors

When Does a Clinical Data Abstraction Contractor Need a BAA?

A clinical data abstraction contractor generally needs a business associate agreement (BAA) when it performs abstraction or related services on behalf of a HIPAA-covered entity and uses or discloses protected health information (PHI) to do so. The work may involve reviewing medical records, extracting clinical data, or entering information into a client’s system. HIPAA’s business associate definition also covers a contractor that creates, receives, maintains, or transmits PHI on behalf of a covered entity. See HHS guidance on business associates.

The agreement should be in place before the covered entity discloses PHI to the contractor. If the contractor is engaged by another business associate rather than directly by a covered entity, it generally needs a subcontractor BAA with that business associate before receiving PHI. HHS sample BAA provisions describe these written-assurance requirements.

A separate BAA is generally not required when an individual is a member of the covered entity’s workforce. Workforce status depends on the relationship and, for an independent contractor, whether the covered entity has direct control over the person’s work; labels in a contract alone do not settle the question. See HHS’s Summary of the HIPAA Privacy Rule.

Define Permitted Uses and Disclosures of PHI

Describe the abstraction services and the PHI the contractor may use, receive, create, maintain, or transmit to perform them. Specify permitted activities—such as reviewing records and entering approved data into designated systems—and state that the contractor may not use or further disclose PHI except as the BAA permits or as required by law. The HHS sample BAA provisions explain these required contract terms.

Set practical boundaries for the work, including who may access PHI, which systems may be used, and whether the contractor may retain working files. Address both paper records and electronic protected health information (ePHI), and prohibit unrelated uses such as using identifiable patient information for the contractor’s own purposes unless a specific legal basis and agreement provision permit it.

The BAA should also describe any Privacy Rule duties the contractor will perform for the covered entity. If the contractor is not responsible for a particular duty—such as responding to individual access requests—make clear how it will provide necessary assistance and records to the covered entity. The BAA must require the contractor to support applicable individual-rights obligations when those tasks are assigned to it.

Require HIPAA Safeguards and Incident Reporting

Require appropriate safeguards against uses or disclosures that the BAA does not permit. For ePHI, the HIPAA Security Rule applies to business associates; contract terms should require the contractor to comply with applicable Security Rule requirements. The parties can specify safeguards appropriate to the work, such as role-based access, secure transfer and storage, workforce training, and procedures for handling records. See HHS’s Summary of the HIPAA Security Rule.

Require prompt reporting of unauthorized uses or disclosures and security incidents, along with cooperation in investigating and mitigating them. A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. That is the outer federal deadline, not a recommended operational target; a BAA can set a shorter reporting deadline so the covered entity has time to assess and meet its own obligations. See the HHS Breach Notification Rule guidance and HHS guidance on security-incident reporting.

Specify the information the contractor must provide, such as what happened, when it was discovered, which systems and records may be involved, and what steps have been taken to contain or investigate the event. The contractor’s notice to its client is distinct from any required notices to affected individuals or government agencies.

Address Individual Rights and Compliance Reviews

If the contractor maintains PHI needed to respond to an individual’s request for access, amendment, or an accounting of disclosures, require it to provide that information to the covered entity as the BAA directs. If the contractor performs a covered entity’s Privacy Rule obligation, the agreement must require it to comply with the requirements applicable to that task. See HHS sample BAA provisions.

Require the contractor to make its relevant internal practices, books, and records available to the U.S. Department of Health and Human Services for compliance review. The BAA can also establish reasonable procedures for the covered entity to conduct a compliance review of the contractor’s relevant documentation and verify compliance with the agreement. Such reviews should focus on the PHI and services covered by the arrangement.

Set Written BAA Requirements for Subcontractors

If the contractor engages a subcontractor that will create, receive, maintain, or transmit PHI to perform the abstraction work, require the contractor to obtain a written subcontractor BAA before providing access. The subcontractor agreement must impose the same applicable restrictions and conditions on PHI that bind the contractor. This requirement applies through the chain of subcontractors handling PHI. See HHS business associate guidance.

Require the contractor to identify relevant subcontractors, monitor their compliance, and report any subcontractor incident involving PHI. The contractor remains responsible for ensuring that its subcontractors agree in writing to the required protections; a general promise to follow HIPAA without the necessary written terms may not satisfy the BAA requirement.

Specify Termination and PHI Return or Destruction

State what happens to PHI when the agreement or services end. If feasible, the contractor must return or destroy PHI received from, or created or received on behalf of, the covered entity and retain no copies. The agreement should address the contractor’s copies and those held by its subcontractors. See HHS sample BAA provisions.

If returning or destroying particular PHI is infeasible, the BAA should require the contractor to explain why in writing, continue to protect the PHI, and limit further uses and disclosures to the purpose that makes disposition infeasible. It should also authorize termination for a material violation, consistent with the applicable BAA requirements.

A clear BAA defines the contractor’s permitted work, safeguards PHI and ePHI, sets reporting and individual-rights responsibilities, flows protections down to subcontractors, and documents PHI disposition at termination.

FAQs

When does a clinical data abstraction contractor need a business associate agreement?

Generally, when the contractor performs abstraction services on behalf of a covered entity and uses or handles PHI to do the work. If the contractor is engaged by another business associate, it generally needs a subcontractor BAA before receiving PHI. A person who qualifies as part of the covered entity’s workforce is generally treated differently.

What uses and disclosures of PHI should the agreement permit?

The BAA should permit only the uses and disclosures needed for the agreed abstraction services, identify the work and relevant PHI, and prohibit other uses or disclosures except as required by law or otherwise permitted under the agreement and HIPAA.

What must the contractor report after an unauthorized disclosure or breach?

The contractor must report uses or disclosures not permitted by the BAA and security incidents as required by the agreement. For a breach of unsecured PHI, it must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. The agreement can require faster notice and specify what details the contractor must provide.

What happens to PHI when the agreement ends?

If feasible, the contractor must return or destroy the PHI and retain no copies. If return or destruction is infeasible, the contractor should document the reason, continue protecting the PHI, and limit its use and disclosure to the purpose that makes disposition infeasible.