Business Associate Agreement Requirements for Document Imaging and Scanning Bureaus

When a document imaging or scanning bureau handles records for a healthcare provider, health plan, or another HIPAA business associate, its contract should explain how protected health information (PHI) is used, safeguarded, reported, and ultimately returned or destroyed.

A business associate agreement (BAA) is not a certificate of HIPAA compliance. It is a required written agreement that allocates specific obligations between the parties; the bureau must also follow applicable HIPAA requirements and the covered entity’s relevant policies.

When does a document imaging bureau need a BAA?

A bureau generally needs a BAA when it performs scanning, indexing, storage, retrieval, or related services on behalf of a HIPAA covered entity or another business associate and the work involves PHI. A scanning vendor’s role—not whether its staff intend to read the records—determines whether the relationship requires a BAA.

PHI can be in any form or medium, including paper, electronic, or oral information. A bureau handling identifiable medical records as part of its contracted work is therefore not exempt simply because it has not yet converted the records into digital files. HHS describes PHI as information in any form or medium and explains that entities performing services involving PHI may be business associates in its Business Associates guidance.

The narrow conduit exception generally applies to entities that merely transmit PHI, with only temporary storage incidental to transmission. Scanning, indexing, or storing records as a service is different from merely transporting or transmitting them. If the bureau is a subcontractor of another business associate, it should enter into a written agreement with that business associate before receiving PHI.

Even a vendor that maintains encrypted electronic PHI without the decryption key may still be a business associate. HHS explains that the ability to view the information is not required for business associate status in its guidance on encrypted ePHI.

Define permitted uses and disclosures of PHI

The BAA should clearly describe the services the bureau will perform and the permitted and required uses and disclosures of PHI needed for those services. For example, it may authorize handling records to receive, prepare, scan, index, quality-check, store, and return them according to the client’s instructions.

The agreement must also restrict the bureau from using or disclosing PHI beyond what the agreement permits or what law requires. If the contract allows uses for the bureau’s proper management and administration, or for legal responsibilities, it should set out the required conditions and limits rather than grant broad permission to use PHI for unrelated purposes.

Define practical boundaries, such as who may access records, whether temporary copies may be made, how errors are corrected, and whether the bureau may retain working files or backups. The contract should address secure transfer methods and prevent uses such as marketing or independent data analysis unless specifically authorized and legally permitted.

These are core BAA terms under 45 CFR § 164.504(e), which requires the agreement to establish permitted and required uses and disclosures and to restrict other uses.

Required HIPAA safeguards for scanned and electronic PHI

The bureau must apply safeguards suited to the PHI and the work it performs. The HIPAA Privacy Rule requires appropriate safeguards for PHI in any form; when the bureau creates, receives, maintains, or transmits electronic protected health information (ePHI), the HIPAA Security Rule’s applicable requirements also apply.

For ePHI, the Security Rule requires a risk analysis and security management measures that protect confidentiality, integrity, and availability. The BAA should require the bureau to comply with applicable Security Rule obligations and make clear how the parties divide responsibilities when both have a role in protecting the same information. See 45 CFR § 164.308 and 45 CFR § 164.314.

Operational safeguards for an imaging workflow may include:

• Limiting workforce access to personnel who need PHI for assigned tasks, with appropriate training and supervision.
• Securing pickup, transport, intake, staging, scanning, quality review, storage, and delivery of paper files.
• Using appropriate access controls, audit practices, and protections against unauthorized alteration, loss, or disclosure of ePHI.
• Protecting scanners, workstations, removable media, and systems that store or transmit PHI, including when equipment is reused or disposed of.
• Maintaining procedures for responding to security incidents and restoring access to ePHI when needed.

HIPAA does not make every security technology mandatory in every circumstance. For example, encryption is an addressable Security Rule implementation specification, meaning the regulated entity must assess whether and how it is reasonable and appropriate, document its decision, and implement an equivalent alternative when appropriate. A risk-based approach should be documented rather than treating any single tool as proof of compliance.

Reporting security incidents and breaches

The BAA must require the bureau to report impermissible uses or disclosures of PHI and security incidents of which it becomes aware. It should spell out the reporting channel, the information to include, who to contact, and the required timeframe for routine incidents. The Security Rule requires security incident reporting, but does not set one universal reporting deadline or format for every incident; the parties should define those details in the contract.

A breach of unsecured PHI has a separate federal deadline. A business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovering the breach. The 60-day limit is an outside deadline, not a recommended target; a BAA may require earlier notice. The rule and the information the bureau must provide are set out in 45 CFR § 164.410.

The bureau should promptly provide available details needed for the covered entity’s investigation and notifications, including affected individuals where known, the types of PHI involved, and relevant circumstances. The covered entity remains responsible for determining and carrying out applicable individual and HHS notifications unless the parties have separately assigned permitted tasks to the bureau. HHS summarizes these distinctions in its guidance on business associate security incident reporting.

Flowing BAA obligations down to subcontractors

If the bureau engages a subcontractor that will create, receive, maintain, or transmit PHI for the bureau’s work, the bureau must obtain the required written assurances before allowing that subcontractor to handle the information. The subcontractor agreement must impose the same applicable restrictions and conditions that bind the bureau.

This can apply to off-site storage providers, cloud or backup services, outsourced indexing teams, and other vendors with PHI access. The bureau should identify which subcontractors are involved, confirm the written terms are in place, and establish a process to respond if a subcontractor violates its obligations.

The requirement for subcontractor written assurances follows from 45 CFR § 164.504(e) and, for ePHI, 45 CFR § 164.314. HHS also explains that a business associate must establish an agreement with its subcontractor before disclosing PHI in its Business Associates guidance.

Supporting individual rights and HHS compliance reviews

A covered entity is responsible for responding to individual requests under the HIPAA Privacy Rule, but a BAA must require the bureau to help when its records are needed. Depending on the services and records held, the bureau may need to make PHI available for access requests, amendments, and accounting of disclosures, or carry out an assigned task on the covered entity’s behalf.

Set practical procedures for locating and producing records quickly, preserving their original context, and routing requests received directly from individuals to the covered entity. If the bureau is assigned a covered entity obligation under the Privacy Rule, the agreement must require it to comply with the requirements that apply to that task. HHS explains the respective roles in its guidance on business associates and individual rights.

The BAA must also provide that the bureau will make its internal practices, books, and records relating to PHI available to the Secretary of HHS for purposes of determining the covered entity’s compliance. This supports an HHS compliance review; it does not transfer the covered entity’s overall responsibility for its own HIPAA duties to the bureau. See 45 CFR § 164.504(e).

Returning or destroying PHI when the agreement ends

At termination, the BAA must require the bureau to return or destroy PHI received from or created for the covered entity, if feasible. The parties should agree on how originals, scanned images, indexes, temporary work files, and copies held by subcontractors will be handled, and how the bureau will confirm completion.

If returning or destroying some PHI is infeasible, the BAA must extend its protections to that information and limit further uses and disclosures to the purposes that make return or destruction infeasible. The bureau should identify any retained data, explain why it cannot be returned or destroyed, and continue to protect it for as long as it remains in its possession. HHS describes this termination requirement in its guidance on retaining ePHI after services end.

For paper records, destruction methods should render the PHI unreadable and not reconstructable; electronic media require appropriate removal or destruction methods. HHS discusses examples in its guidance on disposing of PHI.

In short, a sound scanning bureau BAA defines the permitted workflow, safeguards paper and electronic PHI, sets clear incident-reporting procedures, carries obligations down to subcontractors, supports individual rights and HHS review, and controls PHI at contract end.

FAQs

Does a document scanning bureau need a BAA if it only handles paper records?

Usually, yes, if the bureau handles PHI on behalf of a covered entity or another business associate as part of its scanning or records service. PHI may be protected in paper form; the fact that the bureau has not created ePHI does not by itself remove the need for a BAA. The HIPAA Security Rule applies to ePHI, while appropriate Privacy Rule safeguards apply to PHI in any form.

What uses and disclosures of PHI should a scanning bureau BAA permit?

The agreement should authorize only the uses and disclosures reasonably needed to perform the specified services, such as receiving, preparing, scanning, indexing, quality-checking, storing, and returning records. It should prohibit other uses or disclosures except as required by law and define any narrowly allowed administrative uses, subcontractor access, and required reporting.

How quickly must a bureau report a breach or security incident?

For a breach of unsecured PHI, the bureau must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. The BAA can—and often should—set a shorter deadline. For other security incidents, the agreement should specify a prompt reporting timeframe because HIPAA does not set one universal deadline for every type of incident.

What must happen to PHI when a BAA ends?

The bureau must return or destroy PHI if feasible, as required by the BAA. If return or destruction is infeasible, the agreement must continue to protect the retained PHI and limit further uses and disclosures to the reasons that make return or destruction infeasible.