Business Associate Agreement Requirements for Healthcare Forensic Accounting Firms

When Does a Healthcare Forensic Accounting Firm Need a BAA?

A healthcare forensic accounting firm generally needs a business associate agreement (BAA) when it performs services for a HIPAA-covered health plan, healthcare provider, or clearinghouse and, as part of those services, creates, receives, maintains, or transmits protected health information (PHI). Accounting is specifically recognized as a business associate service when it involves PHI. The covered entity must obtain written assurances requiring the firm to protect the information. See HHS guidance on business associates and BAAs.

The role and direction of the work matter. A firm engaged by a covered entity to investigate claims, analyze patient-related financial records, or provide forensic accounting may be a HIPAA business associate. A firm engaged by another business associate may instead be that entity’s subcontractor business associate if it handles PHI on the associate’s behalf. By contrast, simply receiving health information in a dispute does not automatically make a firm a business associate; the relationship must meet HIPAA’s definition.

OCR’s 2025 settlement with an accounting firm illustrates that accounting firms can be business associates when their work for a covered entity involves PHI. In that case, OCR found a failure to conduct a required ePHI risk analysis; the announcement does not establish that every forensic accounting engagement requires a BAA. See HHS OCR’s accounting-firm settlement announcement.

What Permitted Uses and Disclosures of PHI Should the BAA Define?

The BAA should describe the PHI uses and disclosures the firm needs to perform the agreed forensic accounting services. Be specific: the scope might cover reviewing and reconciling relevant patient billing or claims records, analyzing financial transactions, preparing findings for the client, and communicating those findings to authorized recipients. The agreement may also permit disclosures required by law.

Limit use to the engagement and prohibit uses or disclosures not authorized by the BAA or required by law. The agreement should address requests and uses consistent with the covered entity’s minimum-necessary policies, and should not permit conduct that would violate the HIPAA Privacy Rule if performed by the covered entity. If the firm needs PHI for internal administration or legal responsibilities, or wants to de-identify information, the BAA should address those uses and any conditions expressly. HHS provides sample language and explains these options in its sample business associate agreement provisions.

What Safeguards and Incident Reporting Duties Must the Firm Follow?

The BAA should require the firm to implement appropriate safeguards for PHI and comply with applicable HIPAA Security Rule requirements for electronic protected health information (ePHI). This includes policies and procedures to prevent, detect, contain, and correct security violations, along with risk analysis and risk management measures for ePHI. Safeguards should reflect the firm’s actual systems, the information it handles, and identified risks; encryption is an important safeguard to assess, but the Security Rule’s technical standards should not be reduced to a one-size-fits-all checklist.

The agreement must require reporting of security incidents the firm becomes aware of. It should spell out how and when the firm reports incidents, what details it provides, and how it will help investigate and mitigate them. A security incident is not necessarily a reportable breach of unsecured PHI, but the contract must still address incident reporting. See HHS guidance on reporting security incidents.

If an incident is a breach of unsecured PHI, the firm must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. That is the federal outside limit, not a recommended response target; a BAA can set a shorter deadline so the covered entity has time to investigate and meet its own notification duties. The firm should provide available information about affected individuals and other details the covered entity needs. See the HHS Breach Notification Rule guidance.

How Must the Firm Support Individual Privacy Rights?

The covered entity remains responsible for responding to individuals’ rights requests, but the BAA must make the firm’s cooperation workable. If the firm holds PHI in a designated record set, the agreement should require it to make that information available to the covered entity when needed to respond to an access request and to amend relevant records when directed. It should also require the firm to provide information about its disclosures so the covered entity can prepare an accounting when required.

The parties may agree that the firm will handle a request directly, but the agreement should clearly assign that task and set the process and response time. Not every accounting workpaper is automatically part of a designated record set; the obligation depends on the records held and the firm’s role. See HHS guidance on business associates and individual rights.

What BAA Requirements Apply to Subcontractors?

If the firm uses a subcontractor that creates, receives, maintains, or transmits PHI on its behalf, the firm must obtain a written agreement requiring that subcontractor to protect the information and comply with applicable HIPAA requirements. This can apply to technology, hosting, document management, or data-analysis vendors that handle PHI—not just to firms providing accounting services.

The subcontractor agreement should impose protections at least as stringent as those that apply to the firm, including appropriate security safeguards, incident and breach reporting, limits on permitted uses and disclosures, and return or destruction terms. The firm should also maintain a clear inventory of vendors with PHI access and ensure the contractual chain covers each one. HHS describes these requirements in its business associate guidance.

What Must the BAA Say About HHS Access and Termination?

The BAA must provide that the firm will make its internal practices, books, and records relating to PHI available to the Secretary of HHS for purposes of determining compliance with the HIPAA Rules. The firm must cooperate with applicable HHS compliance reviews and investigations; this access is for compliance purposes, not a general authorization for unrestricted disclosure. See the HHS sample BAA provisions and HHS guidance on business associate liability.

The agreement should also establish what happens if a material breach or violation occurs. A covered entity that learns of a material breach must take reasonable steps to cure it or end the violation and, if unsuccessful, terminate the arrangement when feasible. If termination is not feasible, it must report the problem to HHS. The parties should define notice, cooperation, and transition steps so termination does not leave PHI unprotected.

How Should PHI Be Handled When the Agreement Ends?

The BAA must require the firm, when the relationship ends, to return or destroy PHI if feasible. It should specify the method, timing, and any confirmation of return or destruction, including for copies held by subcontractors. The firm should also stop using and disclosing the PHI except as needed to complete that process.

If return or destruction is infeasible, the BAA must require the firm to continue protecting the PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible. The agreement should address records that must be retained under applicable law or are subject to a legal hold, and document the protections that will continue during retention. These are core provisions described in HHS’s sample BAA provisions.

In short, a sound BAA connects the forensic firm’s defined work to limits on PHI use, meaningful safeguards, prompt incident reporting, subcontractor controls, support for privacy rights, HHS access, and a clear end-of-engagement process.

FAQs.

When does a healthcare forensic accounting firm need a business associate agreement?

When it performs services for a covered entity—or as a subcontractor for another business associate—and creates, receives, maintains, or transmits PHI on that party’s behalf. Accounting services involving PHI are a recognized example. The specific relationship and work determine whether a BAA is required.

What PHI uses and disclosures may a BAA permit?

A BAA may permit uses and disclosures reasonably tied to the specified services, plus disclosures required by law and other uses allowed by HIPAA when properly described. It should prohibit unrelated or unauthorized use and align requests and disclosures with applicable minimum-necessary limits.

Must a forensic accounting firm report security incidents and breaches?

Yes. The BAA must require reporting of security incidents. For a breach of unsecured PHI, the firm must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery; the agreement may require faster notice.

What happens to PHI when the BAA ends?

The firm must return or destroy PHI if feasible. If that is infeasible, it must continue safeguarding the PHI and restrict further use or disclosure to the limited purposes that prevent return or destruction.