Business Associate Agreement Requirements for Release of Information Vendors

When does a release of information vendor need a BAA?

A release of information (ROI) vendor generally needs a business associate agreement (BAA) when a HIPAA covered entity engages it to perform work involving protected health information (PHI)—for example, managing records requests, retrieving or preparing records, or sending records on the entity’s behalf. The key question is whether the vendor creates, receives, maintains, or transmits PHI while performing services for the covered entity, not what the vendor calls its role. The HHS business associate guidance explains when service providers are business associates and when a written agreement is required.

The BAA should describe the vendor’s services and the permitted PHI uses and disclosures needed to perform them. A BAA is generally not required for a vendor whose services do not involve PHI and whose access, if any, would be merely incidental. The HHS sample business associate provisions outline the required agreement terms.

What uses and disclosures of PHI should the BAA permit?

Define the permitted uses and disclosures narrowly enough to match the ROI work: such as receiving requests, locating responsive records, preparing them for release, and transmitting them to recipients authorized by the covered entity. Require the vendor to use or disclose PHI only as the BAA permits or as required by law, and prohibit other uses or disclosures. A BAA cannot authorize conduct that would violate the HIPAA Privacy Rule if a covered entity did it, subject to limited regulatory exceptions. See HHS’s explanation of BAA requirements.

Specify how the vendor will handle the covered entity’s instructions, authorization and identity-verification processes, and any limits on a requested disclosure. If the vendor performs a Privacy Rule duty on the covered entity’s behalf, the BAA must require it to follow the requirements applicable to that duty. The HHS business associate guidance describes these limits and delegated-obligation requirements.

Which safeguards and incident-reporting duties must the BAA require?

The BAA must require appropriate safeguards against impermissible use or disclosure of PHI and, for electronic PHI (ePHI), compliance with applicable HIPAA Security Rule requirements. In practical terms, the parties should define safeguards appropriate to the vendor’s systems and services, including access controls, secure transmission, and protections for stored information. HHS’s sample BAA provisions address safeguards, while its Security Rule summary describes the Security Rule’s requirements.

Require the vendor to report impermissible uses or disclosures, security incidents, and breaches of unsecured PHI. The BAA should set an operational reporting deadline, identify what information the vendor must provide, and require follow-up updates and cooperation with investigation and response. For a breach of unsecured PHI, HIPAA requires a business associate to notify the covered entity without unreasonable delay and no later than 60 days after discovery; the parties may set a shorter contractual deadline. The HHS Breach Notification Rule guidance explains the notice requirement.

How should the BAA address access requests, amendments, and disclosure accounting?

The BAA must ensure the vendor can make PHI available to the covered entity when needed to respond to an individual’s access request. It must also require the vendor to amend PHI in the records it holds when directed by the covered entity, or otherwise assist as the parties agree. The covered entity remains responsible for the individual’s HIPAA rights, but the BAA may assign the vendor particular tasks, including receiving or addressing requests. See HHS guidance on business associates and individual rights.

Require the vendor to provide information about disclosures so the covered entity can prepare an accounting when required. The agreement should explain what the vendor must record and how quickly it must supply the information. HIPAA accounting covers certain disclosures, with exceptions; it is not a requirement to list every disclosure. The HHS accounting guidance describes the individual’s right and its limits.

What obligations apply to subcontractors with access to PHI?

If the ROI vendor uses subcontractors to create, receive, maintain, or transmit PHI on its behalf, the BAA must require the vendor to ensure those subcontractors accept the same restrictions and conditions that apply to the vendor for that PHI. The vendor should put written flow-down terms in place before sharing PHI and remain responsible for managing its subcontracting arrangements. The HHS business associate guidance explains the subcontractor requirements.

Account for the full service chain, including records retrieval, mailing, document storage, and cloud services where applicable. A cloud provider may be a business associate when it maintains ePHI on a covered entity’s or business associate’s behalf, even if the information is encrypted and the provider cannot view it. See HHS guidance on HIPAA and cloud computing.

How should the BAA cover compliance reviews and termination?

The BAA must allow the vendor to make its internal practices, books, and records relating to PHI available to HHS for compliance review. The parties may also negotiate vendor assessments, evidence requests, or audit rights to help evaluate the relationship; these contractual review measures should not be confused with the specific HHS-access provision. HHS explains that covered entities generally are not required to monitor how a business associate carries out its safeguards, but must take appropriate steps if they learn of a material breach or violation. See HHS sample BAA provisions and its guidance on responding to business associate violations.

Authorize the covered entity to terminate the agreement for a material breach or violation. If the covered entity knows of a pattern of noncompliance, it must take reasonable steps to cure the breach or end the violation; if those steps fail, it must terminate the agreement when feasible. If termination is not feasible, the covered entity must report the problem to HHS. The HHS compliance guidance describes these steps.

What happens to PHI when the BAA ends?

At termination, the BAA must require the vendor, if feasible, to return or destroy all PHI received from or created or received on behalf of the covered entity. The agreement should specify the return method, handling of copies and backups where feasible, and how the vendor will document completion. If returning or destroying some PHI is infeasible, the vendor must continue to protect it and limit further uses and disclosures to the purposes that make return or destruction infeasible. See the HHS sample BAA provisions.

In short, an effective ROI BAA defines the vendor’s permitted work, protects PHI throughout the service and subcontractor chain, supports individual rights and breach response, and sets clear procedures for ending the relationship and handling remaining PHI.

FAQs

Does an ROI vendor need a BAA if it handles PHI?

Generally, yes, if a covered entity engages the vendor to handle PHI on its behalf as part of an ROI service. The BAA should describe the work and the permitted uses and disclosures. The relationship and activities matter; the label “ROI vendor” alone does not determine business associate status. See HHS business associate guidance.

Does a software provider need a BAA if it cannot access PHI?

It depends on what the provider does. A provider that only supplies software and does not access or otherwise create, receive, maintain, or transmit PHI on behalf of the covered entity may not need a BAA. But a provider that hosts or stores ePHI may be a business associate even if the information is encrypted and it cannot view it. See HHS guidance on software vendors and HHS cloud computing guidance.

What must an ROI vendor report after an impermissible disclosure or breach?

The BAA must require reporting of impermissible uses or disclosures and breaches of unsecured PHI. For a breach, the vendor must notify the covered entity without unreasonable delay and no later than 60 days after discovery. The agreement can require faster notice and specify the information and cooperation needed to investigate and respond. See the HHS Breach Notification Rule guidance.

Must an ROI vendor return or destroy PHI when the agreement ends?

Yes, if feasible: the BAA must require return or destruction of PHI received from or created or received on behalf of the covered entity. If that is infeasible, the vendor must continue protecting the PHI and restrict its further use or disclosure to the purposes that make return or destruction infeasible. See the HHS sample BAA provisions.