Does a Post-Acute EHR Need a BAA?

Often, yes. If a post-acute care provider is a HIPAA covered entity and its electronic health record (EHR) vendor creates, receives, maintains, or transmits protected health information (PHI) on the provider’s behalf, the vendor is generally a business associate and the parties need a HIPAA Business Associate Agreement (BAA).

The answer depends on what the vendor actually does—not simply on whether the product is called an EHR. Review the vendor’s services, data flows, and access to electronic protected health information (ePHI) before deciding a BAA is unnecessary.

When does a post-acute EHR vendor need a BAA?

A post-acute provider that meets HIPAA’s definition of a covered entity generally needs a BAA with an EHR vendor when the vendor performs a service on the provider’s behalf that involves PHI. This commonly includes hosting or maintaining patient records, providing remote technical support that may access records, or transmitting ePHI for the provider.

Handling can include maintaining ePHI, even when the vendor does not routinely view it. HHS says a cloud service provider that stores or processes ePHI on behalf of a covered entity is a business associate, including when the data is encrypted and the provider lacks the encryption key. See HHS guidance on HIPAA and cloud computing.

By contrast, merely selling or providing software does not by itself create a business associate relationship if the vendor has no access to the provider’s PHI and does not otherwise create, receive, maintain, or transmit it on the provider’s behalf. HHS explains this distinction in its guidance on whether a software vendor is a business associate.

What PHI-related services make an EHR vendor a business associate?

Look at the vendor’s real functions and the full service arrangement. An EHR company may be a business associate if, for example, it:

• Hosts or stores residents’ or patients’ electronic records.
• Maintains, backs up, or restores a system containing ePHI.
• Provides support or troubleshooting that involves access to PHI.
• Processes, organizes, or transmits PHI for the provider.
• Uses a cloud or other service provider to handle ePHI as part of its EHR service.

The relationship is based on the service and the vendor’s role, not on whether staff routinely read the records. HHS identifies cloud providers and IT contractors, including EHR vendors that provide maintenance or support involving ePHI, as examples of business associates in its Business Associates guidance.

What should a post-acute EHR BAA cover?

A BAA must establish the vendor’s permitted and required uses and disclosures of PHI and limit any other use or disclosure. It must also require appropriate safeguards, including applicable HIPAA Security Rule safeguards for ePHI, and require the business associate to report impermissible uses or disclosures and breaches of unsecured PHI.

The agreement should also address how the vendor will help the provider meet applicable obligations involving access, amendments, and accounting of disclosures; make relevant records available to HHS; and return or destroy PHI at termination when feasible. It must authorize the covered entity to terminate the agreement for a material breach. These requirements are outlined in HHS’s sample Business Associate Agreement provisions.

Pay particular attention to breach notification obligations. HIPAA requires a business associate to notify the covered entity after discovering a breach of unsecured PHI, without unreasonable delay and no later than 60 days after discovery. The BAA can set a shorter reporting period so the provider has time to investigate and meet its own notification duties. See the HHS Breach Notification Rule guidance.

How do BAAs apply to EHR vendor subcontractors?

If the EHR vendor uses a subcontractor that creates, receives, maintains, or transmits PHI on the vendor’s behalf, the vendor must obtain written assurances from that subcontractor that it will protect the information and follow the applicable restrictions. The parties commonly document those assurances in a subcontractor business associate agreement.

For example, a hosting provider or support company may be a subcontractor when it handles ePHI for the EHR vendor. The EHR vendor—not ordinarily the post-acute provider—must establish the required agreement with its subcontractor. HHS explains that the business associate contract requirements apply to agreements between business associates and their subcontractors in its Business Associates guidance.

When is a BAA not required?

A BAA is generally not required when the vendor does not create, receive, maintain, or transmit PHI on the provider’s behalf—for example, when it only sells software and has no access to PHI. Confirm that the actual product configuration, support arrangement, and data flows match that description.

HIPAA also recognizes limited exceptions. One is a service that acts only as a conduit for PHI, with only temporary storage incident to transmission; a service that regularly accesses or stores PHI to perform work for a provider generally does not fit that exception. Another is a covered entity’s disclosure of PHI to another health care provider for treatment. That provider-to-provider exception does not automatically exempt an EHR vendor that handles information as part of its service. HHS describes these exceptions in its Business Associates guidance.

A BAA may also not be required when an individual directs a covered entity to send ePHI to an app that does not handle the information on behalf of the provider or its business associate. The circumstances matter; HHS discusses this scenario in its guidance on apps designated by individuals.

How should providers assess EHR access to electronic PHI?

Map where ePHI is created, stored, transmitted, and backed up, then identify which vendor staff and subcontractors can access or maintain it. Ask whether the vendor can support the system remotely, what information is exposed during troubleshooting, and how access is controlled and logged.

Review the vendor’s security practices and incident-response process alongside the BAA. Consider authentication and access controls, encryption, audit logs, backup and recovery, subcontractor arrangements, and how the vendor will return or securely dispose of data when the service ends.

A BAA does not replace the provider’s own Security Rule risk analysis or risk management. Providers should evaluate risks to ePHI in their environment and select reasonable and appropriate safeguards. HHS provides Guidance on Risk Analysis for this purpose.

In short, determine the vendor’s role from its actual handling of PHI, put required protections and responsibilities in a BAA, and assess EHR-related risks as part of the provider’s broader security program.

FAQs

Does a post-acute care provider need a BAA with its EHR vendor?

Generally, yes, if the provider is a HIPAA covered entity and the EHR vendor creates, receives, maintains, or transmits PHI on the provider’s behalf. If the vendor only supplies software and has no access to PHI, a BAA may not be required.

What must a post-acute EHR BAA include?

It must define permitted and required uses and disclosures of PHI; require appropriate safeguards and applicable Security Rule protections for ePHI; address reporting of impermissible uses, disclosures, and breaches; cover relevant individual-rights support, HHS access, subcontractors, and return or destruction of PHI; and allow termination for a material breach.

Does an EHR vendor need BAAs with subcontractors that handle PHI?

Yes. When a subcontractor creates, receives, maintains, or transmits PHI on the EHR vendor’s behalf, the vendor must obtain written assurances that the subcontractor will follow the applicable restrictions and safeguards. A subcontractor BAA is a common way to document them.

When can a post-acute provider use an EHR service without a BAA?

A BAA may not be required if the vendor does not handle PHI on the provider’s behalf, such as a software seller with no PHI access. HIPAA also has limited exceptions, including qualifying conduit services. Providers should verify the vendor’s actual access and functions before relying on an exception.