Business Associate Agreement Requirements for Patient Billing Advocate Firms

When Does a Patient Billing Advocate Firm Need a BAA?

A patient billing advocate firm generally needs a business associate agreement (BAA) when a covered entity—such as a health care provider or health plan—engages the firm to perform billing, claims assistance, or another covered function on its behalf that involves protected health information (PHI). HHS identifies billing and claims processing among the activities that can make a service provider a business associate. The covered entity must have a written agreement in place that meets HIPAA requirements before disclosing PHI for the work. HHS guidance on business associates

The relationship depends on what the firm does and for whom—not simply on whether it sees health information. A patient who independently hires an advocate to help review bills does not, by that fact alone, make the advocate a business associate of a provider or health plan. A BAA is generally needed when the firm performs services involving PHI on behalf of a covered entity. HHS guidance on covered entities and business associates

What Permitted Uses and Disclosures of PHI Should the BAA Define?

The BAA should clearly describe which PHI the firm may use or disclose and for what specific work—for example, reviewing claims, investigating billing errors, communicating with the covered entity, or helping resolve payment issues. It must restrict the firm from using or disclosing PHI beyond what the agreement permits or requires, or what the law requires. The agreement should not authorize uses or disclosures that would violate the HIPAA Privacy Rule if the covered entity made them. HHS sample business associate agreement provisions

Include any permitted use for the firm’s proper management and administration or legal responsibilities only if it is relevant, and set the conditions for disclosures to others. The agreement should also address how the firm will apply the minimum necessary standard to applicable uses, requests, and disclosures, so staff access only the PHI reasonably needed for the assigned purpose. The standard has exceptions, including certain disclosures to health care providers for treatment. HHS minimum necessary guidance

Which Privacy and Security Safeguards Must the Firm Follow?

The BAA must require the firm to safeguard PHI and, for electronic PHI, to comply with applicable HIPAA Security Rule requirements. The HIPAA Security Rule requires appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI). HHS overview of the Security Rule

For a billing advocate, practical safeguards may include limiting workforce access by role, training staff on the firm’s policies, securing devices and workspaces, controlling user access, and maintaining procedures for handling and transmitting records. HIPAA’s requirements are risk-based; the firm should assess risks to ePHI and select and document reasonable safeguards for its environment rather than assume one security setup fits every organization. HHS Security Rule summary

How Should the Firm Report Security Incidents and Breaches?

The BAA must require the firm to report security incidents to the covered entity. It should specify how to report them, whom to contact, what information to provide, and any contractual deadline. The agreement can set a prompt reporting timeline for suspected or confirmed incidents so the covered entity can assess and respond; the contract should distinguish this reporting process from the federal breach-notification deadline. HHS sample business associate agreement provisions

If a breach of unsecured PHI occurs at or by the firm, HIPAA requires the firm to notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. The notice must identify affected individuals to the extent possible and provide available information the covered entity needs to meet its notification duties. The 60-day limit is the federal maximum, not a reason to wait; a BAA may require the firm to report sooner. HHS Breach Notification Rule guidance

What BAA Terms Apply to Subcontractors Handling PHI?

If the firm engages a subcontractor that creates, receives, maintains, or transmits PHI on its behalf, the firm must ensure the subcontractor agrees in writing to the same applicable restrictions and conditions that bind the firm. This business associate subcontractor agreement should be in place before the subcontractor receives PHI. Examples may include a billing platform or a cloud service that stores or processes ePHI. HHS guidance on business associates and subcontractors

The firm should also have a process to address a subcontractor’s material breach or violation, including taking reasonable steps to cure the problem or end it and terminating the arrangement if those steps fail and termination is feasible. HHS sample business associate agreement provisions

How Must the Firm Support Patient Rights and Government Reviews?

The BAA should require the firm to make PHI available to the covered entity as needed to respond to an individual’s access request. It should also require the firm to make requested amendments to PHI in a designated record set when directed by the covered entity and to provide information needed for an accounting of disclosures. The covered entity remains responsible for fulfilling HIPAA duties to individuals, although the parties may agree that the firm will perform particular tasks or respond to requests on the covered entity’s behalf. HHS guidance on business associate duties and individual rights

The BAA must also provide that the firm will make its relevant internal practices, books, and records available to the Secretary of HHS for purposes of determining compliance with the HIPAA Privacy Rule. HHS BAA requirements and sample provisions

What Happens to PHI When the BAA Ends?

The agreement must address what happens to PHI when the BAA ends. If feasible, the firm must return or destroy PHI it still maintains and retain no copies. If return or destruction is infeasible, the BAA must extend its protections to the retained PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible. HHS guidance on business associate agreements

Plan for PHI held by subcontractors as well as information stored in systems, backups, or other formats. The BAA should explain how the firm will return or destroy that information, document completion where appropriate, and protect any PHI that must be retained. HHS sample termination provisions

In short, a well-defined BAA ties the firm’s PHI use to its assigned work, requires appropriate safeguards and incident reporting, flows protections down to subcontractors, supports patient rights and government review, and sets a clear process for PHI at termination.

FAQs

When must a patient billing advocate firm sign a BAA?

A firm generally needs a BAA before a covered entity discloses PHI for the firm to perform billing or another covered service on the entity’s behalf. A patient’s independent decision to hire an advocate does not, on its own, create a business associate relationship.

What uses of PHI can a BAA authorize?

A BAA can authorize uses and disclosures needed for the firm’s specified services, subject to HIPAA and the agreement’s limits. It must restrict other uses and disclosures unless the law requires them or the agreement permits them under applicable HIPAA rules.

Must subcontractors sign a separate agreement before receiving PHI?

When a subcontractor creates, receives, maintains, or transmits PHI on the firm’s behalf, the firm must ensure that the subcontractor agrees in writing to the applicable restrictions and conditions before handling that PHI.

What must the firm do with PHI when the BAA ends?

If feasible, the firm must return or destroy the PHI it still maintains. If that is infeasible, it must continue protecting the retained PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible.