Cloud Backup and Disaster Recovery Vendor BAA Requirements

When does a cloud backup vendor need a HIPAA business associate agreement?

A cloud backup or disaster recovery vendor generally needs a business associate agreement (BAA) when it creates, receives, maintains, or transmits electronic protected health information (ePHI) on behalf of a HIPAA covered entity or another business associate. Because backup services maintain ePHI, a vendor may be a business associate even if it cannot view the data or holds no decryption key. A limited conduit exception applies to transmission-only services with no more than temporary storage incidental to transmission—not to a provider retaining backups. See HHS guidance on HIPAA and cloud computing.

If a covered entity hires the vendor directly, the covered entity and vendor need a BAA. If a business associate hires the vendor to maintain ePHI, the vendor is generally a business associate subcontractor, and the contracting business associate must obtain the required written assurances. A service label, encryption arrangement, or vendor claim of being “HIPAA compliant” does not replace the required agreement.

What must a cloud backup and disaster recovery BAA include?

The BAA should define permitted and required uses and disclosures of PHI, limit other uses and disclosures, and require appropriate safeguards for the ePHI the vendor handles. It should also require the vendor to report impermissible uses or disclosures, security incidents, and breaches as applicable, and explain how the vendor will support the customer’s duties involving individual access, amendments, and accountings. The required contract provisions are summarized in HHS’s sample business associate agreement provisions.

For a backup relationship, make the BAA and related service terms clear about who is responsible for each security control and operational task. Address, as appropriate, encryption and key management, access controls, incident escalation, backup and restoration support, and cooperation during investigations. If the vendor uses subcontractors that handle PHI, the BAA must require the business associate subcontractor flow-down: subcontractors must agree to the same applicable restrictions and conditions for protecting PHI.

The agreement should also address termination. Generally, it must require the vendor to return or destroy PHI when the agreement ends if feasible. If return or destruction is infeasible, the BAA must extend its protections to the retained PHI and limit further uses and disclosures. Specify how the parties will handle backup copies, retention periods, deletion schedules, and confirmation of PHI return and destruction. See HHS’s cloud computing guidance on termination and PHI disposition.

How do HIPAA contingency planning requirements apply to cloud backups?

A cloud backup service can support a HIPAA Security Rule contingency plan, but it does not replace the organization’s plan. The organization remains responsible for establishing and implementing procedures for responding to emergencies that damage systems containing ePHI. The current rule includes a required data backup plan to create and maintain retrievable exact copies, a required disaster recovery plan to restore lost data, and a required emergency mode operations plan to continue critical business processes while protecting ePHI. See 45 CFR § 164.308(a)(7).

The organization’s plan should identify critical applications and data, assign responsibilities, and explain how staff will access restored information and continue essential operations. Testing and revision procedures, as well as an applications and data criticality analysis, are addressable implementation specifications: assess whether each is reasonable and appropriate in the organization’s circumstances, and document the decision and any equivalent alternative measure where applicable. HHS’s ransomware guidance also highlights contingency planning and the value of testing plans to assess readiness.

Plan and test the full recovery process—not only whether backup jobs completed. Include restoration of ePHI, related applications and dependencies, encryption keys, and access needed by authorized staff. Document restoration testing and address identified problems so you can assess whether the data is retrievable and usable when needed.

Which service-level terms should align with the BAA?

HIPAA does not set a universal cloud-backup availability percentage, recovery time objective (RTO), or recovery point objective (RPO). Establish these service levels based on your risk analysis, operational needs, and contingency plan, then make sure they are consistent with the BAA and do not prevent your organization from accessing ePHI. HHS advises that cloud service-level agreements should align with the BAA and HIPAA requirements. See HHS’s cloud computing guidance on service-level agreements.

• Backup and retention: Define covered systems and data, backup frequency, retention periods, and how the vendor will report failed or incomplete backups.
• Recovery commitments: Set agreed RTO and RPO targets, restoration priorities, support availability, and the process for requesting and verifying a restore.
• Security and incident handling: Align incident reporting, escalation contacts, cooperation, and access to ePHI with the BAA. HIPAA requires business associates to report security incidents, but the agreement can clarify the report’s format, detail, and operational timeline, subject to applicable breach-notification requirements. See HHS guidance on cloud-provider security incident reporting.
• Exit and access: Specify data-export formats, transition assistance, continued access during a dispute or termination, and deletion of remaining copies in accordance with the BAA.

Do not treat a service-level promise as proof that the organization’s contingency plan is effective. Confirm that the agreed targets match business priorities and that restoration can be tested in the organization’s environment.

How should organizations assess vendor and cloud configuration risks?

Perform and document your own risk analysis and risk management; a signed BAA alone does not establish that the selected service or configuration is appropriate. Understand the vendor’s service, where ePHI is stored and processed, what subcontractors are involved, and which party operates each security control. HHS specifically advises customers to understand the cloud environment and consider how the chosen configuration affects risk and risk management. See HHS cloud-computing guidance.

• Map ePHI flows, backup copies, administrative access, and relevant subcontractors.
• Review encryption in transit and at rest, key custody and recovery, identity and access controls, logging, and the process for revoking access.
• Assess the risks of accidental deletion, ransomware, compromised credentials, outages, failed restores, and loss of encryption keys.
• Check that backup settings, retention, access permissions, and deletion policies match your documented requirements and recovery plan.
• Record the division of responsibilities between your organization and the vendor, including controls you must configure or operate.

For cloud environments, responsibility is often shared: a vendor may operate some infrastructure controls while the customer configures accounts, permissions, or backup policies. Confirm the actual allocation in writing, and revisit the assessment when services, configurations, or operations change.

What evidence and assurances should organizations request from vendors?

Request evidence that helps you evaluate the specific service and its risks, such as a description of safeguards and control responsibilities, data-flow and architecture information, subcontractor details, incident procedures, and relevant independent assessment reports. For recovery, ask about backup coverage, monitoring of backup jobs, restoration procedures, and the results or summaries of data restoration testing. Tailor requests to the ePHI and service configuration rather than relying on a generic security statement.

HIPAA requires satisfactory assurances through a BAA, but it does not expressly require cloud vendors to provide customers with security documentation or permit customer audits. Customers may negotiate for audit reports, documentation, or other assurances based on their own risk analysis and compliance activities. The BAA must separately provide for applicable HHS access to the business associate’s records for compliance purposes. See HHS’s cloud guidance on vendor documentation and audits and HHS’s BAA provisions.

Do not interpret a vendor’s report, certification, or marketing claim as proof that your organization is compliant. OCR does not endorse, certify, or recommend specific technologies or products. Evaluate available evidence alongside your own risk analysis, documented responsibilities, and tested recovery procedures. In short, choose a vendor whose BAA and service terms support your safeguards and contingency planning, and verify that your organization can actually restore and use its ePHI.

FAQs.

Is a BAA required if the cloud vendor stores only encrypted ePHI?

Generally, yes. A cloud provider that maintains ePHI on behalf of a covered entity or business associate is generally a business associate even if the data is encrypted and the provider has no decryption key. Encryption does not by itself remove the BAA requirement. See HHS guidance on encrypted ePHI in cloud services.

Can a cloud backup service replace a HIPAA contingency plan?

No. A backup service may support the data backup and disaster recovery parts of your plan, but your organization still needs procedures for restoring ePHI, operating in emergency mode, assigning responsibilities, and addressing critical business processes. The Security Rule’s contingency plan requirements are set out in 45 CFR § 164.308(a)(7).

What should happen to ePHI when a cloud backup contract ends?

The BAA should provide for return or destruction of PHI at termination when feasible. If return or destruction is infeasible, the BAA must continue to protect retained PHI and limit its further use and disclosure. Agree on practical details such as export, backup-copy deletion schedules, and how the vendor will confirm completed actions. See HHS guidance on cloud services after termination.

Do cloud backup vendors have to provide audit documentation?

HIPAA does not expressly require a cloud service provider to give customers security documentation or allow them to audit its practices. You may negotiate for audit reports or other evidence based on your risk analysis and compliance needs. This is different from BAA provisions requiring the business associate to make applicable records available to HHS for compliance purposes. See HHS cloud guidance on audits and HHS’s BAA provisions.