Does a Medical Record Retrieval Platform Need a BAA?

When a Medical Record Retrieval Platform Is a Business Associate

A medical record retrieval platform generally needs a HIPAA Business Associate Agreement (BAA) when it performs services on behalf of a HIPAA covered entity or another business associate and, as part of that work, creates, receives, maintains, or transmits protected health information (PHI). That can include requesting, collecting, organizing, storing, or delivering patient records. The specific relationship and services matter: a platform handling records for a provider may be that provider’s business associate, while a platform engaged by another business associate may be a subcontractor.

A platform that only transmits information temporarily may warrant a different analysis, but storing or otherwise maintaining electronic protected health information (ePHI) is not generally treated as a mere conduit. The parties should assess what data the platform handles, whose behalf it acts on, and how the service operates before relying on an exception.

What a HIPAA Business Associate Agreement Must Cover

A BAA should define the platform’s service-related permitted uses and disclosures of PHI and prohibit other uses or disclosures unless required by law. It should also require appropriate safeguards for ePHI, including compliance with applicable HIPAA Security Rule requirements, and address reporting of security incidents and breaches of unsecured PHI.

The agreement should also cover any delegated Privacy Rule duties, access to records by the covered entity or business associate and, where applicable, by the Department of Health and Human Services, and the platform’s obligations when the relationship ends. It should require the platform to impose appropriate protections on its business associate subcontractors. The precise terms should fit the platform’s actual responsibilities rather than rely on a generic description of “HIPAA compliance.”

Why Encrypted PHI May Still Require a BAA

Encryption is an important safeguard, but it does not by itself remove ePHI from HIPAA’s business associate rules. A platform that stores encrypted ePHI on behalf of a covered entity or business associate may still be a business associate even if it cannot decrypt or view the records. Accordingly, lack of an encryption key does not, on its own, eliminate the need for a BAA.

Encryption can affect whether information is considered unsecured for breach-notification purposes under applicable HHS guidance, but that is a separate question from whether a vendor is a business associate.

BAA Requirements for Platform Subcontractors

If the retrieval platform is a business associate and hires a subcontractor to create, receive, maintain, or transmit PHI for the service, the platform must have a written business associate subcontractor agreement with that subcontractor before PHI is disclosed to it. The downstream agreement must require protections consistent with the subcontractor’s role, including applicable Security Rule safeguards.

The covered entity usually enters into its BAA with the platform, while the platform enters into the agreement with its own subcontractors. The covered entity should nevertheless understand the platform’s downstream arrangements and ensure its own BAA addresses the platform’s responsibility for subcontractor compliance.

Defining Permitted Uses and Disclosures by Service Scope

Describe the retrieval platform’s work clearly: for example, whether it locates records, submits requests, receives records, stores them, organizes them, or delivers them to an authorized recipient. The BAA’s permitted uses and disclosures should be limited to what is reasonably needed to perform those agreed services and any other uses expressly permitted by HIPAA or required by law.

Clarify whether the platform may use PHI for support, troubleshooting, quality assurance, or other operational needs, and establish boundaries for any secondary use, such as analytics or product development. Address how the platform will respond to requests to access or amend records if it performs duties on the covered entity’s behalf, as well as what happens to PHI upon termination.

Assessing ePHI Risks and Safeguards

A BAA is a contract, not a substitute for evaluating security. Covered entities and business associates must conduct a risk analysis of the ePHI they create, receive, maintain, or transmit and use the results to guide appropriate safeguards. For a retrieval platform, consider how records move between requesters, record holders, the platform, and subcontractors; where they are stored; who can access them; and how access, security incidents, backups, and data return are handled.

The HIPAA Security Rule calls for administrative, physical, and technical safeguards that protect the confidentiality, integrity, and availability of ePHI. A practical conclusion is straightforward: determine the platform’s role and data handling, document the relevant risks, put the appropriate BAA chain in place, and make the safeguards and contract match the actual service.

FAQs.

Does a medical record retrieval platform need a BAA if it only stores records?

Usually, yes, if it stores PHI or ePHI on behalf of a covered entity or another business associate. Maintaining ePHI can make the platform a business associate even when storage is its only service.

Is a platform a business associate if it cannot decrypt encrypted PHI?

It may still be a business associate. A platform that maintains encrypted ePHI for a covered entity or business associate generally does not avoid business associate status simply because it lacks the decryption key.

Does a covered entity need to sign a BAA with the platform’s subcontractor?

Generally, the platform, as the business associate, must sign a business associate subcontractor agreement with its subcontractor before the subcontractor handles PHI. The covered entity typically signs its BAA with the platform and should ensure that agreement addresses downstream subcontractor protections.

What should a BAA cover for a record retrieval platform?

It should describe the platform’s permitted and required uses and disclosures of PHI, require appropriate safeguards, address security-incident and breach reporting, cover any delegated duties and subcontractors, and specify what happens to PHI when the service ends. The terms should reflect the platform’s actual work and data flows.