Does a Dermatopathology LIS Need a BAA?

A dermatopathology laboratory information system (LIS) does not automatically require a business associate agreement (BAA) just because it handles pathology records. The key question is whether the vendor creates, receives, maintains, or transmits protected health information (PHI) on behalf of a HIPAA covered entity—or otherwise needs access to that PHI to provide its service.

For a laboratory, the answer often depends on how the LIS is deployed and supported: software installed on the lab’s own systems may be different from a hosted system, and remote troubleshooting may change the analysis. HHS guidance on business associates explains the distinctions.

When does a dermatopathology LIS vendor qualify as a business associate?

A dermatopathology LIS vendor generally qualifies as a business associate when it performs a function or service for a covered entity that involves PHI, such as hosting, maintaining, or supporting a system that gives the vendor access to identifiable patient information. A vendor may also be a business associate if it maintains electronic PHI on the laboratory’s behalf, even when the data is encrypted and the vendor lacks the decryption key. HHS cloud-computing guidance addresses these situations.

The vendor’s role matters more than the software’s label. A lab should assess what the vendor does in practice, including whether it can access patient names, specimen details, diagnoses, images, or other identifiable records while providing its service. Whether the laboratory itself is a covered entity depends on its activities, including whether it conducts covered electronic transactions.

Does an on-premises LIS require a BAA if the vendor cannot access PHI?

Not necessarily. HHS says that merely selling or providing software does not create a business associate relationship when the vendor has no access to the covered entity’s PHI. Accordingly, an on-premises LIS may not require a BAA if the lab operates it and the vendor cannot access PHI to install, maintain, troubleshoot, or otherwise support the software. HHS’s software-vendor FAQ explains this distinction.

Confirm that “no access” reflects the actual arrangement, not just the vendor’s usual practice. Review remote-access permissions, administrative accounts, support tools, diagnostic logs, and data exports. If vendor personnel can view or retrieve PHI during support, the relationship may require a BAA before access is provided. Use reasonable access controls and safeguards regardless of whether a BAA is required.

How do hosting and technical support affect BAA requirements?

Hosting commonly makes the hosting provider a business associate when it stores or processes ePHI for the laboratory. That can be true even if the provider does not routinely view records or holds only encrypted data. The lab should have a BAA in place before the provider maintains or accesses ePHI on the lab’s behalf. HHS cloud guidance explains why a cloud provider’s inability to decrypt stored information does not, by itself, remove its business associate obligations.

Technical support can also affect the answer. Remote troubleshooting, database administration, backups, software updates, or maintenance may involve access to ePHI. If the vendor’s service requires access to PHI, treat the vendor as a potential business associate and put the required agreement in place before enabling that access. HHS’s examples of business associates include IT vendors that maintain or support systems involving ePHI.

What should a dermatopathology LIS BAA include?

A business associate agreement should describe the business associate’s permitted uses and disclosures of PHI and limit any other use or disclosure, except as required by law. It should also require appropriate safeguards for PHI, including applicable HIPAA Security Rule protections for ePHI. HHS’s sample BAA provisions outline required contract elements.

For an LIS arrangement, make the permitted uses and disclosures specific enough to cover the vendor’s actual work, such as hosting, technical support, maintenance, and backups. The agreement should also address:

• Reporting impermissible uses or disclosures and security incidents, including breaches of unsecured PHI as required by HIPAA.
• Helping the laboratory meet applicable duties involving individual access, amendments, and accounting of disclosures, when relevant to the service.
• Making relevant records available to HHS for compliance review.
• Returning or destroying PHI when the agreement ends, when feasible, and addressing any PHI that cannot feasibly be returned or destroyed.
• Requiring subcontractors that handle PHI to accept the applicable restrictions and safeguards.
• Providing for termination when the business associate materially violates the agreement.

A BAA is one part of HIPAA compliance, not a substitute for the laboratory’s own risk analysis, policies, and security measures. The parties should align contract terms with how the LIS is configured, who can access PHI, and how support requests are handled.

How should laboratories manage subcontractors and security incidents?

If an LIS vendor uses a subcontractor to create, receive, maintain, or transmit ePHI for the vendor’s work, the vendor must obtain appropriate written assurances from that subcontractor. These subcontractor obligations should flow down the relevant HIPAA protections and contract restrictions. The laboratory should ask the vendor to explain which subcontractors handle PHI and how those relationships are covered. HHS guidance on business associates and subcontractors describes this chain of responsibility.

The BAA must require the business associate to report security incidents of which it becomes aware, including breaches of unsecured PHI as required by the Breach Notification Rule. HIPAA does not prescribe one universal reporting format or level of detail for every security incident, so the parties can set practical procedures in the agreement. Specify reporting contacts, escalation steps, and what information the lab needs to assess and respond. HHS guidance on cloud-provider incident reporting discusses these requirements.

When can a laboratory receive patient information without a BAA?

A covered entity may disclose PHI to a health care provider, including a clinical laboratory, for the treatment of an individual without a BAA between those providers. HHS specifically states that a physician does not need a business associate contract with a clinical laboratory as a condition of disclosing PHI to the laboratory for treatment. HHS’s business associate guidance describes this treatment exception.

This exception concerns the provider-to-provider disclosure for treatment; it does not automatically exempt a separate LIS vendor, cloud host, or technical-support company that handles PHI on a provider’s behalf. For example, a technology intermediary used to facilitate an exchange may itself need a BAA. HHS’s guidance on health information organizations explains this distinction.

In short, determine whether the LIS vendor or its subcontractors access or maintain PHI on the laboratory’s behalf. Software-only delivery without PHI access may not require a BAA, while hosting or support that involves PHI generally does; treatment disclosures from one provider to a laboratory are a separate exception.

FAQs

Does a dermatopathology LIS vendor need a BAA if it only provides software?

Not if the vendor only sells or provides software and has no access to the laboratory’s PHI. If it needs access to PHI for hosting, maintenance, troubleshooting, or another service, it may be a business associate and a BAA is generally required before access. HHS’s software-vendor FAQ explains the distinction.

Does cloud hosting of pathology records require a BAA?

Generally, yes, when the cloud provider creates, receives, maintains, or transmits ePHI on behalf of the laboratory or another business associate. Encryption or lack of a decryption key does not by itself eliminate the BAA requirement. HHS cloud-computing guidance covers cloud providers’ business associate status.

Can vendor troubleshooting create a business associate relationship?

Yes. If troubleshooting requires the vendor to access PHI, the vendor may be a business associate even when the LIS is installed on the laboratory’s own premises. A BAA should be in place before the vendor receives that access. HHS’s software-vendor FAQ gives troubleshooting as an example.

Is a BAA required when a provider discloses patient information to a laboratory for treatment?

No. HIPAA does not require a BAA for a covered provider’s disclosure of PHI to a laboratory for treatment purposes. That exception applies to the treatment disclosure between providers, not necessarily to technology vendors that host or support the systems used to handle the records. HHS’s business associate guidance explains both points.