Does Genetic Test Ordering Software Need a BAA?

When does genetic test ordering software qualify as a business associate?

Genetic test ordering software generally needs a business associate agreement (BAA) when a HIPAA-covered provider uses the vendor to handle protected health information (PHI) on the provider’s behalf. For example, a platform may qualify as a business associate if it creates, receives, maintains, or transmits identifiable patient details or test orders to manage the provider’s genetic testing workflow.

What matters is the vendor’s role and access to the information—not simply that the product is software or is used in healthcare. A vendor that hosts patient data or can access it while troubleshooting may be a business associate. By contrast, a vendor that only supplies software and cannot access PHI may not be one, according to HHS guidance on software vendors.

Cloud hosting and support can also count. HHS says a cloud service provider that creates, receives, maintains, or transmits electronic PHI on behalf of a covered entity or business associate is a business associate—even if the data is encrypted and the provider lacks the decryption key. See HHS guidance on HIPAA and cloud computing.

Is genetic information protected health information under HIPAA?

Genetic information is not automatically PHI in every setting. Under HIPAA, it is protected health information when it is individually identifiable health information held or transmitted by a covered entity or its business associate. A genetic test result linked to a patient’s name, medical record, or other identifiers in a covered provider’s workflow will generally meet that description. HHS explains how HIPAA applies to genetic information.

Information that has been properly de-identified under HIPAA is not PHI for purposes of the Privacy and Security Rules. HIPAA provides two methods for de-identification: Safe Harbor and Expert Determination. Simply removing a name does not by itself establish that genetic information is de-identified. Review HHS guidance on HIPAA de-identification for the applicable standard and methods.

If a vendor is already acting as a business associate, its act of de-identifying PHI is still a use of PHI. The BAA must authorize that activity; after information is properly de-identified, it is no longer PHI under HIPAA, subject to other applicable laws. HHS addresses this distinction in its guidance on business associates and de-identification.

When should a BAA be signed in the genetic testing workflow?

When the vendor is a business associate, the covered organization should have a BAA in place before it allows the vendor to access or handle PHI. That includes access through a live order, test result, patient account, support session, hosting environment, or backup—not just routine viewing of the data. HHS says a BAA is required before a software company that needs PHI access to provide its service is allowed that access. See HHS’s software-vendor guidance.

The BAA should identify permitted and required uses and disclosures, require appropriate safeguards, address incident and breach reporting, and cover relevant subcontractors. It should also set out what happens to PHI when the service or agreement ends. These are among the provisions described in HHS’s sample BAA provisions.

Consider the whole workflow rather than only the ordering screen. Determine whether PHI reaches the platform through an electronic health record integration, is stored in vendor systems, appears in support logs, or is sent to a laboratory or other downstream service provider.

When might genetic test ordering software not need a BAA?

A BAA may not be required when a software vendor cannot access PHI and does not create, receive, maintain, or transmit it on behalf of a covered entity. A BAA may also not be required for a vendor that receives only information properly de-identified under HIPAA. HHS confirms that a cloud provider maintaining only HIPAA-de-identified information is not a business associate on that basis. See HHS’s guidance on de-identified information.

Direct-to-consumer genetic testing needs a separate role analysis. If an individual independently chooses an app or service to receive their information, and the app is not handling PHI on behalf of a covered provider, that relationship alone does not make the app a business associate. But a platform provided by or working for a clinic—or one that handles PHI to carry out the clinic’s services—may require a BAA. The answer depends on the relationship and data flow, as explained in HHS guidance on apps and BAAs.

Do not assume that a product is outside HIPAA merely because it is marketed directly to consumers or because genetic information is involved. Assess who sends the data, who controls the service, and whether the vendor performs a function for a covered entity.

What HIPAA Security Rule obligations apply to software vendors?

When a vendor is a business associate and handles electronic PHI, the HIPAA Security Rule applies to the vendor’s relevant activities. The vendor must implement appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of that information. A BAA documents responsibilities; signing one does not replace the vendor’s Security Rule obligations.

Depending on the vendor’s environment and risks, safeguards may include risk analysis and risk management, workforce security and training, access controls, audit controls, incident response, contingency planning, and transmission security. HIPAA’s Security Rule is flexible and risk-based; the appropriate measures depend on the organization’s circumstances. See the HHS summary of the HIPAA Security Rule.

The BAA must also address applicable obligations involving subcontractors that handle electronic PHI, and require reporting of security incidents. Business associates are directly responsible for complying with applicable HIPAA requirements; a BAA does not transfer those responsibilities away. HHS summarizes these contract and vendor responsibilities in its business associate guidance.

How should healthcare organizations assess a genetic testing platform?

Before selecting a platform or allowing it to handle patient data, map the genetic testing workflow and identify each organization that receives or can access information. Ask whether the data includes identifiers, test orders, results, family history, or other information linked to a patient, and determine whether the vendor handles that information on the organization’s behalf.

• Confirm the vendor’s role: Determine whether the vendor is a business associate, a subcontractor, or a provider that handles information outside the organization’s behalf.
• Trace the data: Ask where PHI is stored, transmitted, backed up, and exposed during support or troubleshooting.
• Review the BAA: Check that it limits uses and disclosures, addresses safeguards and incident reporting, covers relevant subcontractors, and explains return or destruction of PHI at termination.
• Evaluate safeguards: Ask how the vendor manages access, audit logs, risk, incidents, and continuity, and document the organization’s own assessment.
• Verify de-identification claims: If the vendor says it receives only de-identified health information, confirm that the data meets a HIPAA de-identification method and that any preceding PHI use is authorized.

In short, genetic test ordering software needs a BAA when its vendor handles identifiable PHI on behalf of a covered organization. Determine the vendor’s role from the actual workflow, put the agreement in place before access begins when required, and assess safeguards independently of the contract.

FAQs

Does genetic information count as protected health information under HIPAA?

It can. Genetic information is PHI when it is individually identifiable health information held or transmitted by a covered entity or business associate. Information that is properly de-identified under HIPAA is not PHI under the Privacy Rule.

When should a BAA be executed with a genetic testing platform?

If the platform is a business associate, execute the BAA before allowing it to access or handle PHI. The agreement should cover the platform’s permitted uses, safeguards, incident reporting, subcontractors, and handling of PHI when the service ends.

Is a BAA required for direct-to-consumer genetic testing orders?

Not automatically. A BAA may not be required when a consumer independently directs information to a service that does not handle PHI on behalf of a covered entity. If a clinic provides the platform or the vendor handles PHI to perform services for the clinic, a BAA may be required.

Does signing a BAA remove a vendor’s HIPAA Security Rule obligations?

No. A BAA sets contractual requirements, but a business associate that handles electronic PHI remains responsible for applicable Security Rule obligations, including appropriate safeguards and incident response.