Business Associate Agreement Requirements for Medical Interpreter Agencies

When does a medical interpreter agency need a BAA?

A medical interpreter agency generally needs a business associate agreement (BAA) when a healthcare provider or other HIPAA covered entity engages the agency to provide interpreting services on its behalf and the work involves access to protected health information (PHI). HHS specifically identifies ongoing contractual relationships with interpreter services as arrangements that should comply with the HIPAA Privacy Rule’s business associate agreement requirements. HHS guidance on interpreters

The key question is the agency’s role, not simply whether an interpreter might hear health information. An interpreter engaged by a provider to perform services on the provider’s behalf may be a business associate. By contrast, a patient’s family member, friend, or other person the patient identifies as their interpreter for a particular encounter is not a business associate on that basis alone. HHS guidance on interpreters

The covered entity is responsible for obtaining the required written assurances before disclosing PHI to a business associate. If the agency is acting as a subcontractor for another business associate, it may need a BAA with that business associate instead. Whether HIPAA applies depends on the parties’ roles and the services performed. HHS Business Associates guidance

Define permitted uses and disclosures of PHI

State precisely why the agency may use or disclose PHI—for example, to provide interpretation services requested by the provider—and limit access to what is reasonably needed for that work. The agreement should prohibit uses or disclosures outside its terms or those required by law. It should also address any permitted disclosures for the agency’s proper management and administration, where applicable. HHS sample BAA provisions

For practical clarity, specify how interpreters may receive encounter details, communicate with the provider, and handle notes, recordings, messages, or scheduling information that contain PHI. Do not treat the BAA as a blanket authorization for unrelated uses such as marketing or an agency’s independent reuse of patient information.

Require safeguards and incident reporting

Require the agency to use appropriate administrative, physical, and technical safeguards to prevent unauthorized use or disclosure of PHI. For electronic PHI, the BAA must require compliance with applicable HIPAA Security Rule requirements. Tailor the agreement and related procedures to the agency’s actual workflows, including interpreter devices, remote sessions, access controls, transmission, and secure handling of records. HHS sample BAA provisions

The BAA must require the agency to report uses or disclosures not permitted by the agreement, including breaches of unsecured PHI. Define who receives a report, how quickly the agency must provide it, and what details it must include, such as the information involved, affected individuals if known, and steps taken to investigate and reduce harm. HIPAA sets an outside limit of 60 days after discovery for a business associate’s breach notification to the covered entity; the agreement can require faster reporting so the provider has time to meet its own duties. HHS sample BAA provisions 45 C.F.R. § 164.410

Address patient access, amendments, and accounting

The covered entity remains responsible for responding to patient requests for access, amendments, and an accounting of disclosures. The BAA must require the agency to make relevant PHI available to the covered entity, make or support amendments as directed, and provide information about disclosures when needed for the covered entity’s response. The parties may also agree that the agency will respond to patients directly, but that responsibility should be clearly assigned. HHS guidance on business associates and individual rights

Clarify how the agency will promptly route requests it receives, locate and provide records, incorporate approved amendments, and document disclosures that must be included in an accounting. This is especially important if the agency holds PHI that is not otherwise maintained by the provider.

Extend BAA obligations to subcontractors

If the agency uses a subcontractor that creates, receives, maintains, or transmits PHI on its behalf, the agency must obtain written assurances that the subcontractor will follow the same applicable restrictions and conditions. This subcontractor business associate agreement requirement can apply to services such as interpreting support, transcription, scheduling, or technology that handles PHI. HHS Business Associates guidance

Make the agency responsible for identifying relevant subcontractors, maintaining their written agreements, and ensuring that required safeguards and incident-reporting duties flow down the chain. Check that the actual service arrangement matches the agreement, rather than relying on a general confidentiality clause alone.

Set termination and PHI return or destruction terms

Provide that, when the BAA ends, the agency will return or destroy PHI received from or created or received on behalf of the covered entity, if feasible. The agreement should also address PHI held by subcontractors and specify what happens when return or destruction is not feasible. In that situation, the agency must continue to protect the PHI and limit further uses and disclosures to the purposes that make its continued retention necessary. HHS sample BAA provisions

For an effective agreement, connect these terms to the agency’s records, systems, and subcontractor arrangements, and state how the parties will verify that required return or destruction has occurred. In short, a medical interpreter agency’s BAA should reflect its actual role, narrowly define PHI handling, and establish workable safeguards, reporting, patient-rights support, subcontractor, and termination procedures.

FAQs

Does a medical interpreter agency need a BAA when it handles PHI for a healthcare provider?

Usually, yes, when the provider engages the agency to provide interpreting services on its behalf and the services involve PHI. The provider and agency should assess the arrangement and document the required assurances in a BAA. A patient’s own chosen family member or other interpreter for a particular encounter is a different situation and is not a business associate on that basis alone. HHS guidance on interpreters

What incidents must an interpreter agency report under a BAA?

The agency must report uses or disclosures of PHI that are not permitted by the BAA, including breaches of unsecured PHI, and any other incidents the agreement requires it to report. The BAA should set a specific reporting process and timeline; HIPAA’s outer limit for a business associate’s breach notice to the covered entity is 60 days after discovery. HHS sample BAA provisions 45 C.F.R. § 164.410

Must subcontractors sign written agreements covering PHI?

Yes, when a subcontractor creates, receives, maintains, or transmits PHI on the agency’s behalf. The agency must obtain written assurances requiring the subcontractor to follow the applicable PHI protections and restrictions. HHS Business Associates guidance

What must happen to PHI when the BAA ends?

If feasible, the agency must return or destroy PHI received from or created or received on the covered entity’s behalf. If that is not feasible, the agreement must provide for continued protection and restrict further uses and disclosures to the purposes that make retention necessary. HHS sample BAA provisions