Does Donor Search Software Need a BAA?

Sometimes. Donor search software needs a business associate agreement (BAA) when a HIPAA-covered entity—or a business associate acting for one—uses the vendor to create, receive, maintain, or transmit protected health information (PHI) on its behalf. A vendor that only handles genuinely non-PHI prospect information may not need a BAA under HIPAA.

The key questions are what information the service handles, whose work it performs, and whether it stores or processes PHI—not whether the vendor calls its product “donor search” software. HIPAA’s business associate guidance explains the relevant relationship.

When does donor search software qualify as a business associate?

A donor-search vendor may be a HIPAA business associate when a covered entity engages it to perform a function or service involving PHI. For example, a hospital that supplies patient or service information to a vendor so the vendor can match records, screen donors, or prepare fundraising lists may create a business associate relationship.

The vendor does not have to make clinical decisions or be able to read every record. The relationship depends on whether it handles PHI on behalf of the covered entity. A vendor that only supplies wealth estimates or other prospect data from sources unrelated to a covered entity’s PHI may fall outside HIPAA’s business-associate rules for that work.

HIPAA generally requires a covered entity to have a written BAA with a business associate. The agreement defines permitted uses and disclosures, requires safeguards and incident reporting, addresses subcontractors, and covers return or destruction of PHI when feasible at termination. See HHS’s sample business associate agreement provisions.

When is a BAA required before sharing donor data?

Before a covered entity shares PHI with a donor-search vendor to perform work on its behalf, it should have the required BAA in place and confirm that the planned use or disclosure is permitted under HIPAA. A BAA governs the vendor’s handling of PHI; it does not, by itself, authorize every fundraising use of patient information.

First determine whether the data is PHI and whether the vendor is acting for the covered entity. If the data contains only non-health prospect details and is not linked to identifiable health information, HIPAA may not require a BAA. But do not treat information as non-PHI simply because it came from a public source: information can become PHI when linked to a person’s care or health status.

Limit any PHI shared for the purpose to what is permitted and needed. HIPAA’s minimum necessary standard generally requires reasonable steps to limit use, disclosure, and requests for PHI to the minimum necessary for the intended purpose, subject to the standard’s exceptions.

How do cloud storage and processing affect BAA requirements?

Cloud storage or processing does not remove the BAA requirement when a cloud provider creates, receives, maintains, or transmits electronic protected health information (ePHI) on behalf of a covered entity or its business associate. HHS says a cloud service provider can be a business associate even if it stores only encrypted ePHI and does not hold the decryption key.

The narrow conduit exception generally applies to transmission-only services with only temporary storage incident to transmission; it does not ordinarily cover persistent cloud storage. A donor-search platform should therefore account for the whole data path, including storage, backups, analytics, and subcontractors. Review HHS guidance on HIPAA and cloud computing when evaluating cloud services.

Which donor-search data counts as PHI?

PHI is individually identifiable information relating to a person’s past, present, or future health or condition, the provision of health care, or payment for health care, when held or transmitted by a covered entity or its business associate. Names, addresses, birth dates, and other identifiers are not PHI on their own in every context; they can be PHI when connected to identifiable health information.

For example, a prospect’s name and publicly available address alone are not necessarily PHI. Linking that person to a hospital visit, treatment date, health insurance status, or other identifiable care information can change the analysis. See HHS’s guidance on protected health information and de-identification.

Electronic records containing PHI are ePHI and are subject to applicable HIPAA Security Rule requirements. Removing names alone does not necessarily de-identify a dataset; HIPAA recognizes specific de-identification methods and criteria.

What HIPAA rules apply to fundraising screening?

HIPAA permits a covered entity to use or disclose certain specified PHI for fundraising for its own benefit without an individual authorization, subject to conditions. The permitted information includes demographic information, dates of health care, department of service, treating physician, outcome information, and health insurance status. The current text of 45 CFR § 164.514(f) sets out the categories and requirements.

The covered entity must include the applicable fundraising statement in its notice of privacy practices and provide a clear, conspicuous way to opt out with each fundraising communication. It must make reasonable efforts to honor opt-outs and may not condition treatment or payment on a person’s choice about receiving fundraising communications.

These permissions do not give a vendor blanket authority to use all information in a medical record for donor screening. If a proposed use or disclosure is outside HIPAA’s permitted fundraising rules or another applicable permission, the covered entity may need an individual authorization or another valid basis. Assess the specific data and purpose before sharing it.

What safeguards should donor-search vendors use?

A vendor acting as a business associate must meet applicable HIPAA requirements, including safeguards for ePHI under the Security Rule. HHS describes the Security Rule as requiring appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI. Its Security Rule summary covers these safeguard categories.

When assessing a vendor, ask how it limits user access, protects data in storage and transit, records relevant system activity, manages security incidents, backs up and restores data, and controls subcontractors. Confirm that its BAA addresses permitted uses, incident reporting, subcontractor obligations, and return or destruction of PHI where feasible. These safeguards should be evaluated in light of the parties’ roles and risks; a vendor’s claim that a product is “HIPAA compliant” does not replace the covered entity’s own review and responsibilities.

In short, a donor-search vendor needs a BAA when it handles PHI for a HIPAA-covered entity or its business associate. Determine whether the data is PHI, confirm the fundraising use is permitted, and address cloud services and safeguards before sharing the information.

FAQs.

Does a donor-search vendor need a BAA if it never accesses PHI?

If the vendor truly does not create, receive, maintain, or transmit PHI on behalf of a covered entity or business associate, HIPAA generally does not require a BAA for that service. “Never accesses” should not mean merely that vendor staff cannot view the data: a provider that maintains encrypted ePHI may still be a business associate even without the decryption key.

Does cloud storage of donor data require a BAA?

Not automatically for all donor data. If a cloud provider stores or processes ePHI on behalf of a covered entity or business associate, a BAA is generally required—even when the information is encrypted and the provider cannot view it. Cloud storage of data that is not PHI does not, by itself, create a HIPAA BAA requirement.

Can a covered entity use PHI for fundraising without patient authorization?

HIPAA allows a covered entity to use or disclose specified categories of PHI for fundraising for its own benefit without authorization, if it meets the rule’s notice and opt-out requirements. Other data or uses may require authorization or another valid HIPAA permission, so assess the proposed use rather than assuming all fundraising screening is allowed.

What safeguards should a donor-screening service provide?

A service acting as a business associate should implement safeguards appropriate to its role and risks, meet applicable Security Rule requirements, and follow the BAA’s restrictions. Ask about access controls, audit logging, data protection, incident response, backups, subcontractors, and secure return or destruction of PHI where feasible.