Business Associate Agreement Requirements for External Peer Review Organizations

When Does an External Peer Review Organization Need a BAA?

An external peer review organization generally needs a business associate agreement (BAA) when it performs peer review, utilization review, quality assurance, or related services on behalf of a HIPAA covered entity and, in doing so, creates, receives, maintains, or transmits protected health information (PHI). HHS lists utilization review and quality assurance among business associate functions and identifies a consultant performing utilization reviews for a hospital as an example. See the HHS Business Associates FAQs.

The relationship and the nature of the information exchange matter. A covered entity generally must have a written BAA in place before disclosing PHI to a business associate. Exceptions can apply—for example, a disclosure to another health care provider for treatment purposes does not require a BAA. If the review organization receives only properly de-identified information, or does not perform services on the entity’s behalf involving PHI, a BAA may not be required. Assess the actual arrangement rather than relying only on the organization’s name or the label “peer review.”

What HIPAA Provisions Must the BAA Include?

The HIPAA Privacy Rule requires the BAA to describe the review organization’s permitted and required uses and disclosures of PHI, and to prohibit uses or disclosures outside the agreement or those required by law. The agreement must also require appropriate safeguards and support the covered entity’s Privacy Rule duties when those duties are delegated to the business associate. HHS summarizes the required provisions in its Sample Business Associate Agreement Provisions.

Among other required terms, the BAA must address reporting impermissible uses and disclosures, including breaches of unsecured PHI; access to PHI needed for individual access, amendment, and accounting obligations; cooperation with applicable Privacy Rule requirements; access by HHS to relevant records; return or destruction of PHI at termination when feasible; and termination for a material violation. The BAA should authorize only the PHI uses and disclosures needed for the contracted review work, subject to permitted exceptions under HIPAA.

How Should the Agreement Address PHI Safeguards and Breach Reporting?

The BAA should require the organization to protect PHI from unauthorized use or disclosure. When the work involves electronic PHI, the HIPAA Security Rule also applies: the agreement must require the business associate to comply with applicable Security Rule requirements and to report security incidents. The parties can specify practical reporting channels, the information to include, and how routine incident reports will be handled. HHS explains these obligations in its guidance on security incident reporting.

Set a prompt contractual deadline for notifying the covered entity of suspected or confirmed incidents, unauthorized disclosures, and potential breaches so it can investigate and meet its own obligations. Under the Breach Notification Rule, a business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery; a BAA may require faster notice. The covered entity remains responsible for required notices to affected individuals and, where applicable, HHS and the media, unless it delegates notice tasks to the business associate. See HHS Breach Notification Rule guidance.

For review work, the agreement should also limit the information shared to what is reasonably necessary for the stated purpose, consistent with the minimum necessary standard where it applies. The standard has exceptions, including certain disclosures to health care providers for treatment. HHS explains the rule and its exceptions in its Minimum Necessary Requirement guidance.

What Written Assurances Are Required from Subcontractors?

If the peer review organization engages a business associate subcontractor that will create, receive, maintain, or transmit PHI on its behalf, it must obtain written assurances requiring the subcontractor to follow the same applicable restrictions and conditions that apply to the organization. The organization should put the subcontractor’s agreement in place before disclosing PHI for the work. This requirement applies down the chain of business associate subcontractors as well as to the organization directly. See the HHS Business Associates FAQs.

Identify subcontractors that may handle PHI—such as records reviewers, technology vendors, or document-processing providers—and define their permitted access and responsibilities. The covered entity’s BAA is with the peer review organization; the organization is responsible for obtaining the required assurances from its own subcontractors.

What Peer Review Services and Deliverables Should the Contract Define?

HIPAA requires the BAA to describe permitted and required PHI uses and disclosures, but the parties should also define the peer review engagement clearly in the service contract. Specify the review purpose and scope, the records or data to be provided, the review methodology or applicable criteria, the expected format and timing of reports, and who may receive the results. These details help align the organization’s access to PHI with the work it is authorized to perform.

Document how the organization will request additional records, handle questions or corrections, restrict access to assigned reviewers, and return or securely destroy PHI when the work ends, subject to applicable legal retention requirements and the BAA. State whether the organization may use information for any additional purpose; do not assume the BAA permits independent uses such as research, publication, or product development. Any permitted use or disclosure must be consistent with HIPAA and the agreement.

How Must Covered Entities Respond to Material BAA Violations?

When a covered entity learns of a material breach or violation by its business associate, it must take reasonable steps to cure the breach or end the violation. If those steps are unsuccessful, it must terminate the BAA if feasible. If termination is not feasible, the covered entity must report the problem to the HHS Office for Civil Rights (OCR). These are response duties when the covered entity becomes aware of a violation; HIPAA does not generally require it to monitor every business associate’s day-to-day safeguard practices. See the HHS guidance on responding to business associate violations.

In practice, document the concern, investigate credible information, take reasonable corrective steps, and assess whether the organization has cured the problem. If not, decide whether termination is feasible and report to OCR when it is not. If the issue involves a breach of unsecured PHI, separately follow applicable breach notification requirements; resolving a contract violation does not replace those duties.

In short, determine whether the reviewer handles PHI on the covered entity’s behalf, put the required BAA in place before disclosure, limit PHI use to the authorized work, require appropriate safeguards and downstream written assurances, and respond promptly to known material violations.

FAQs.

Must an external peer review organization sign a BAA before receiving PHI?

Generally, yes, if it is acting as a business associate by performing review services on behalf of a covered entity that involve PHI. The covered entity should have the required written agreement in place before disclosing the PHI, unless an exception applies. For example, a BAA is not required for a covered entity’s disclosure to another health care provider for treatment purposes. See the HHS Business Associates FAQs.

What uses and disclosures of PHI may a BAA permit?

A BAA may permit the uses and disclosures needed to perform the contracted peer review services, as well as other uses or disclosures HIPAA allows the agreement to authorize, such as certain activities for the business associate’s proper management and administration or data aggregation for the covered entity’s health care operations. The agreement must identify permitted and required uses and disclosures and cannot authorize conduct that would violate the Privacy Rule if done by a covered entity. See the HHS guidance on BAA-authorized uses and disclosures.

Do peer review subcontractors need written BAAs?

When a subcontractor creates, receives, maintains, or transmits PHI on behalf of the peer review organization, the organization must obtain written assurances requiring the subcontractor to follow the applicable restrictions and conditions that apply to the organization. The written agreement should be in place before PHI is disclosed to the subcontractor for the work.

What should a covered entity do after discovering a material BAA violation?

Investigate the information, take reasonable steps to cure the breach or end the violation, and terminate the agreement if those steps fail and termination is feasible. If termination is not feasible, report the problem to OCR. If the incident also constitutes a breach of unsecured PHI, follow the applicable breach notification requirements as well. See HHS guidance on material business associate violations.