Business Associate Agreement Requirements for Healthcare Accreditation Consultants

Healthcare accreditation consultants may review policies, evaluate quality programs, or help prepare an organization for accreditation. If their work involves protected health information (PHI), the HIPAA Rules may require a written business associate agreement (BAA) that defines permitted uses, safeguards, reporting duties, and what happens to information when the engagement ends.

When Is a Healthcare Accreditation Consultant a Business Associate?

A consultant may be a business associate when, outside the covered entity’s workforce, the consultant provides accreditation or consulting services to or for a covered entity and the service involves disclosure of PHI. A person may also be a business associate when they create, receive, maintain, or transmit PHI on a covered entity’s behalf to perform a regulated function.

The consultant’s title alone does not decide the question. Consider what services the consultant performs, whose behalf they perform them on, and whether the work involves PHI. For example, a consultant who reviews identifiable patient records as part of an accreditation-readiness project may need a BAA; a consultant who receives no PHI may not. The federal definition of business associate at 45 C.F.R. § 160.103 expressly includes certain accreditation and consulting services involving PHI, and HHS guidance on accreditation organizations explains when such organizations are business associates.

If the consultant qualifies as a business associate, the covered entity generally must obtain satisfactory assurances through a written contract or other arrangement before disclosing PHI. A BAA is not a substitute for assessing whether the consultant’s actual access and activities fall within HIPAA’s business-associate definition. See HHS guidance on covered entities and business associates.

What Must a Written Business Associate Agreement Include?

A BAA must describe the consultant’s permitted and required uses and disclosures of PHI, and prohibit other uses or disclosures except as required by law. It must also require safeguards against unauthorized use or disclosure, including applicable HIPAA Security Rule protections for electronic protected health information (ePHI).

The written agreement must also address the consultant’s duties to:

• Report uses or disclosures not allowed by the agreement, including breaches of unsecured PHI.
• Make PHI available to help the covered entity respond to individual access, amendment, and accounting obligations.
• Comply with applicable Privacy Rule requirements when performing a covered entity’s Privacy Rule obligations.
• Make relevant internal practices, books, and records available to HHS for compliance review.
• Ensure subcontractors with access to PHI agree to applicable restrictions and conditions.
• Return or destroy PHI at termination when feasible, and authorize termination for a material breach.

These are federal requirements, not merely optional contract terms. The parties may add practical details—such as approved systems, access limits, reporting contacts, or a shorter incident-reporting deadline—so long as the agreement meets the applicable requirements. See HHS’s required BAA provisions and sample language.

Which PHI Uses and Disclosures May the Agreement Permit?

Describe permitted uses and disclosures with enough specificity to match the consultant’s accreditation work. For example, the agreement may authorize review of specified records for a defined assessment, documentation of findings, or communication of relevant results to the covered entity. A broad authorization to use PHI for any purpose is not a substitute for setting appropriate limits.

A business associate generally may use or disclose PHI only as allowed by its BAA or required by law. The agreement cannot authorize a use or disclosure that would violate the HIPAA Privacy Rule if the covered entity made it. The parties may also address limited uses allowed for the business associate’s proper management and administration or for data aggregation related to the covered entity’s health care operations, subject to applicable conditions. See HHS’s business associate guidance.

Where applicable, the agreement should define how the consultant will apply the minimum-necessary standard to uses, disclosures, and requests for PHI. Limit access to the information needed for the accreditation task, and specify whether reports should use de-identified information or a limited data set when that will serve the purpose.

What Safeguards and Incident Reporting Duties Apply?

The HIPAA Security Rule requires appropriate administrative, physical, and technical safeguards for ePHI a business associate creates, receives, maintains, or transmits. The safeguards should reflect the consultant’s environment and the risks to the confidentiality, integrity, and availability of the information. See HHS’s summary of the HIPAA Security Rule.

The agreement must require the consultant to report a use or disclosure not permitted by the BAA, as well as security incidents and breaches of unsecured PHI. A security incident is not necessarily a reportable breach; the BAA can set procedures for reporting incidents, including the detail and timing of routine incident reports. For a breach of unsecured PHI, the business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery; the parties may agree to a shorter reporting deadline. See HHS guidance on security incident reporting and the HIPAA Breach Notification Rule.

For useful response and investigation, specify whom the consultant must contact, what information to include, and how promptly to report suspected incidents. Those operational details help the covered entity assess the event and meet its own breach-notification responsibilities.

How Must Consultants Support Individual Rights and HHS Oversight?

The covered entity remains responsible for fulfilling Privacy Rule duties concerning individuals’ rights, including access to PHI in a designated record set, amendment, and accounting of certain disclosures. The BAA must require the consultant to make relevant PHI available to the covered entity when needed to meet those duties. The agreement may also assign the consultant specific tasks, but it should clearly state how requests are routed and who responds. See HHS guidance on business associates and individual rights.

The BAA must also provide that the consultant makes relevant internal practices, books, and records available to the Secretary of HHS for purposes of determining the covered entity’s HIPAA compliance. This access obligation concerns records relating to the consultant’s use and disclosure of PHI received from, or created or received on behalf of, the covered entity.

What Must Consultants Require of Subcontractors?

If the consultant uses a subcontractor that creates, receives, maintains, or transmits PHI on the consultant’s behalf, the consultant must obtain a written agreement requiring that subcontractor to comply with applicable restrictions and conditions and to safeguard ePHI as required. This obligation can apply to a downstream service provider even if the covered entity did not hire that provider directly.

Before giving a subcontractor access, identify what PHI it will handle and confirm that the written terms address permitted uses, safeguards, incident reporting, and any further subcontracting. The same downstream protection principle applies through the business-associate chain. See HHS’s BAA provisions for subcontractors.

What Happens to PHI When the Agreement Ends?

At termination, the BAA must require the consultant to return or destroy PHI received from or created or received on behalf of the covered entity, if feasible. The parties should specify the return method, destruction process, handling of backups, and documentation of completion.

If returning or destroying PHI is infeasible, the agreement must extend its protections to the retained information and limit further uses and disclosures to the purposes that make return or destruction infeasible. For example, another legal retention requirement may make immediate destruction impracticable. See HHS guidance on PHI after a business associate relationship ends.

Conclusion

For healthcare accreditation consultants, BAA requirements depend on the services performed and whether they involve PHI. When a BAA is required, it should define permitted uses, safeguard PHI and ePHI, set incident-reporting procedures, support individual rights and HHS oversight, bind relevant subcontractors, and explain how PHI will be handled when the engagement ends.

FAQs

Does every healthcare accreditation consultant need a business associate agreement?

No. A BAA is generally required when the consultant’s accreditation or consulting service for a covered entity involves disclosure of PHI, or when the consultant creates, receives, maintains, or transmits PHI on the entity’s behalf in a way that meets the business-associate definition. If the consultant does not handle PHI, a BAA may not be required for that engagement. See 45 C.F.R. § 160.103.

What must a consultant report under a business associate agreement?

The agreement must require reporting of uses or disclosures not permitted by the BAA, security incidents, and breaches of unsecured PHI. For a breach, federal rules require notice to the covered entity without unreasonable delay and no later than 60 calendar days after discovery; the contract may require a shorter deadline. See the HHS Breach Notification Rule guidance.

Can a consultant share PHI with a subcontractor?

Yes, when the disclosure is permitted for the consultant’s work and the consultant obtains the required written assurances from the subcontractor. The subcontractor must agree to applicable PHI restrictions and safeguards before receiving PHI on the consultant’s behalf. See HHS’s BAA provisions for subcontractors.

When can a data use agreement replace a business associate agreement?

HHS identifies a limited circumstance for accreditation organizations: a covered entity may disclose only a limited data set, without direct identifiers, to an accreditation organization under a limited data set data use agreement (DUA) as an alternative to a BAA. This is not a general substitute when the consultant receives PHI beyond the limited data set or performs other work requiring a BAA. See HHS guidance on accreditation organizations and its limited data set guidance.