Business Associate Agreement Requirements for Video Remote Interpreting Vendors

When does a video remote interpreting vendor need a BAA?

A video remote interpreting (VRI) vendor generally needs a business associate agreement (BAA) when it performs services for a HIPAA covered entity—or for another business associate—and creates, receives, maintains, or transmits protected health information (PHI) on that entity’s behalf. In a healthcare interpreting session, an interpreter may hear or see information about a patient’s care, while the VRI platform may transmit or store call data. Whether a BAA is required depends on the vendor’s role and handling of PHI, not simply on whether it records a session.

The HHS guidance on business associates explains that entities performing services involving PHI for covered entities may be business associates. A vendor that only provides a transmission service may qualify for the narrow conduit exception, but that exception is not a general exemption for vendors that provide healthcare services or regularly access PHI.

Transient access alone does not settle the question. HHS describes conduit access as transient and limits the exception to transmission-only services, including temporary storage incident to transmission. A VRI company that supplies interpreters, processes sessions, or maintains session information is doing more than simply carrying a communication from one point to another. By contrast, a telecommunications provider that only transmits the call and has no other role may fall within the exception. See the HHS explanation of the conduit exception.

Which permitted uses and disclosures of PHI should the BAA specify?

The BAA should describe the PHI uses and disclosures the vendor needs to perform the contracted VRI service, such as connecting a patient and interpreter, routing a call, and handling the minimum information needed to deliver the session. It should also state that the vendor may not use or further disclose PHI except as the agreement permits or as law requires. The HHS sample business associate agreement provisions identify these as required BAA terms.

Be specific about optional or secondary activities. If the vendor may use PHI for its proper management and administration or data aggregation, the BAA should define the permitted activity and applicable conditions. It should also address recordings, transcripts, chat messages, call metadata, quality review, analytics, and artificial-intelligence tools. Do not assume that a general permission to provide interpreting services authorizes recording sessions, creating transcripts, or using PHI to train a model.

Set clear boundaries on access and disclosure, including who may access PHI, for what purpose, and how the vendor will handle requests to disclose it. The terms should align with the covered entity’s applicable minimum-necessary policies and should not authorize uses or disclosures that would violate the HIPAA Privacy Rule if made by the covered entity. HHS explains these limits in its guidance on business associate uses and disclosures.

What Privacy Rule and Security Rule duties must the vendor meet?

The BAA must require the vendor to use appropriate safeguards for PHI and, for electronic PHI, to comply with the applicable requirements of the HIPAA Security Rule. The Security Rule calls for administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic PHI. HHS summarizes these obligations in its HIPAA Security Rule guidance.

For a VRI service, the contract should assign responsibility for relevant controls across the vendor’s platform and operations. Depending on the service and risk assessment, practical terms may address unique user access, authentication, session privacy, secure transmission, audit logs, workforce training, incident response, and retention. These contract details help define how the parties will meet their obligations; they should not be presented as a one-size-fits-all list of safeguards dictated identically for every vendor.

The BAA should also require the vendor to make PHI available as needed for the covered entity to meet applicable individual rights obligations, such as access, amendment, and accounting duties. If the vendor is performing a covered entity’s Privacy Rule function, the agreement must require it to comply with the requirements that apply to that function. It should also provide for access by HHS to relevant internal practices, books, and records for compliance review. See the HHS list of required BAA provisions.

How should the BAA address security incidents and breaches of unsecured PHI?

The agreement should require the vendor to report uses or disclosures not permitted by the BAA and security incidents involving the covered entity’s electronic PHI. It should distinguish a security incident—which may include unsuccessful attempts to access a system—from a breach of unsecured PHI, which triggers separate notification obligations. The HHS sample provisions address reporting both security incidents and breaches.

For a breach of unsecured PHI, the vendor must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery under the Breach Notification Rule. That 60-day period is the federal outer limit for the business associate’s notification to the covered entity, not a recommended target for routine contract administration. The parties can agree to a shorter reporting period so the covered entity has time to investigate and meet its own obligations. See HHS breach notification guidance and 45 CFR § 164.410.

Specify what the vendor’s report must include, such as available details about affected individuals, the information involved, and the vendor’s investigation and mitigation steps. The covered entity generally remains responsible for required notices to affected individuals, HHS, and, when applicable, the media, although the BAA may allocate notification tasks to the vendor. The agreement should make those responsibilities and cooperation duties explicit.

What obligations apply to the vendor’s subcontractors?

If the vendor uses subcontractors that create, receive, maintain, or transmit PHI on its behalf, it must obtain written assurances requiring them to follow the same applicable restrictions and conditions that bind the vendor. That chain may include an interpreter agency, video platform, cloud host, transcription provider, or other service provider, depending on what the subcontractor does with PHI.

The VRI vendor’s BAA should require it to identify and manage relevant subcontractors, execute appropriate downstream agreements before allowing them to handle PHI, and report subcontractor incidents or breaches to the covered entity. A subcontractor that performs business associate functions is itself subject to applicable HIPAA obligations. HHS describes these business associate subcontractor obligations in its guidance.

What happens to PHI when the VRI service ends?

The BAA should require the vendor, when the relationship ends, to return or destroy PHI received from or created on behalf of the covered entity, if feasible. Specify how the vendor will handle active records, recordings or transcripts if authorized, session logs, and copies held by subcontractors. The agreement can also set deadlines and describe how the vendor will confirm completion.

If returning or destroying some PHI is infeasible, the BAA must require the vendor to continue protecting it and limit further uses and disclosures to the purposes that make its retention necessary. The parties can address backups and other retained copies in the contract so their handling is clear. HHS sets out the return-or-destruction requirement in its sample BAA provisions.

How should BAA duties align with video interpreting service standards?

A BAA governs PHI handling; it does not by itself ensure that an interpreting session is effective. Where applicable, the covered entity’s separate communication-access obligations should be reflected in service requirements, implementation plans, or other contract terms. For example, the ADA’s VRI rules address real-time, full-motion video and audio; clear images showing the participants’ faces, arms, hands, and fingers; audible voices; and adequate user training. See the applicable Title II regulation and Title III regulation.

Contract terms can translate those standards into measurable service expectations, such as technical performance, interpreter availability and qualifications, user support, and procedures for responding to a failed or ineffective connection. The agreement should also clarify that a covered entity must consider whether VRI is effective in the circumstances and arrange another effective communication method when it is not. These service-quality terms complement—but do not replace—the BAA’s Privacy Rule, Security Rule, and breach-reporting provisions.

In short, assess the vendor’s actual role rather than assuming transient access eliminates the need for a BAA. Define permitted PHI handling, safeguards, incident reporting, subcontractor controls, and end-of-service disposition, while separately addressing the VRI standards needed for effective communication.

FAQs

Does a VRI vendor need a BAA if it only has transient access to PHI?

Not necessarily, but transient access alone is not enough to determine whether the vendor qualifies for the conduit exception. The exception is narrow and generally applies to a service that only transmits PHI, with temporary storage incident to transmission. A VRI vendor that provides interpreters or otherwise handles PHI to perform a service for a covered entity will generally need a BAA. See HHS guidance on conduits.

What permitted uses and disclosures of PHI should a VRI BAA cover?

It should cover the uses and disclosures needed to deliver the contracted interpreting service, and any specifically authorized management, administration, or data-aggregation activities. It should prohibit other uses or disclosures except as required by law and define how the vendor handles information such as recordings, transcripts, call metadata, and subcontractor access.

Must a VRI vendor report security incidents and breaches of unsecured PHI?

Yes. The BAA must require reporting of security incidents and impermissible uses or disclosures. For a breach of unsecured PHI, the vendor must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery; the contract may require an earlier deadline. See HHS breach notification guidance.

What must the BAA require when the VRI service ends?

It must require the vendor, if feasible, to return or destroy PHI received from or created on behalf of the covered entity. If that is infeasible, the vendor must continue protecting the PHI and limit further uses and disclosures to the purpose that makes retention necessary.