Does Geriatric Assessment Software Need a BAA?

Often, yes. If a HIPAA covered entity uses geriatric assessment software and the vendor creates, receives, maintains, or transmits protected health information (PHI) on the provider’s behalf, the vendor will generally be a business associate and a business associate agreement (BAA) is required. The key question is what the vendor does with the information—not simply whether its product is called assessment software. See HHS guidance on software vendors and business associates.

When does a geriatric assessment software vendor need a BAA?

A vendor generally needs a BAA when a healthcare provider subject to HIPAA engages it to perform a service involving PHI on the provider’s behalf. For example, an identifiable patient’s assessment answers, cognitive or functional scores, care recommendations, and related records may be PHI when the software processes or stores them for a provider.

This can include a hosted assessment platform, cloud storage, software support that accesses patient records, or another service that handles PHI for the provider. The vendor does not have to routinely read the information: maintaining or transmitting electronic PHI on the provider’s behalf can establish a business associate relationship. HHS explains that cloud providers may need a BAA even when they store only encrypted PHI and lack the encryption key. See HHS guidance on HIPAA and cloud computing.

The provider should have the required written agreement in place before allowing a business associate to access or handle PHI for the service. The agreement should reflect the vendor’s actual role and the data involved.

When might a BAA not be required?

A BAA is not required merely because a provider buys software. If the vendor sells or licenses software but has no access to the provider’s PHI and does not create, receive, maintain, or transmit it on the provider’s behalf, the sale alone does not create a business associate relationship. For example, the provider may install and operate software on its own systems while the vendor cannot access patient information. See HHS’s software vendor FAQ.

A BAA also may not be required when an individual, acting on their own behalf, chooses an app to access their health information. HHS states that facilitating access at the individual’s request alone does not make an app developer a business associate. The answer may differ if the provider arranges or provides the app, or the vendor performs a service involving PHI on the provider’s behalf. See HHS guidance on patient-selected apps.

These exceptions depend on the actual arrangement. A vendor’s claim that it “does not view” patient data is not enough if it still hosts, stores, or transmits that data for the provider.

How to determine whether a vendor handles PHI on behalf of a provider

Review the full service and data flow, not just the software license or privacy statement. Ask:

• Who is the customer, and who is the service for? Determine whether the provider hired or arranged the service to support its care, assessment, or administrative work.
• What information enters the software? Check whether assessment responses, scores, notes, or reports can be linked to an individual.
• What does the vendor do with the data? Include creating, receiving, maintaining, transmitting, hosting, backing up, troubleshooting, and providing support for PHI.
• Who else handles it? Identify cloud hosts and other subcontractors that may access or maintain the information.
• Did the individual choose the app independently? Distinguish an individual’s request to access their own data from a provider’s use of a vendor to perform a service on the provider’s behalf.

If the vendor or its subcontractor handles PHI for the provider, plan for a BAA before the service begins. HHS explains that a covered entity may allow a business associate to handle PHI when it obtains satisfactory assurances that the information will be appropriately safeguarded, documented through a written agreement. See HHS guidance on cloud services that process or store ePHI.

What should a BAA cover?

A BAA should define the vendor’s permitted uses and disclosures of PHI and prohibit uses or disclosures outside the agreement or what the law requires. It should also address the vendor’s HIPAA Security Rule safeguards for electronic PHI, and require reporting of unauthorized uses or disclosures and security incidents.

HIPAA’s required contract terms also address cooperation with the provider’s obligations concerning individuals’ access to, amendment of, and accounting for PHI; making relevant practices and records available to HHS; returning or destroying PHI at termination when feasible; requiring appropriate protections from subcontractors; and allowing termination for a material breach. The contract must not authorize uses or disclosures that would violate HIPAA if the provider made them. See HHS’s sample business associate agreement provisions.

Parties can add practical details such as the specific assessment data covered, vendor and provider contacts, response procedures, support access, data export and deletion, and a security incident and breach reporting process. The BAA can set a faster reporting deadline than HIPAA’s outside limit for notifying the covered entity of a breach of unsecured PHI; it should make clear what information the vendor must provide to help the provider respond.

How should vendors manage subcontractors that access PHI?

A vendor that is a business associate must obtain written assurances from a subcontractor that creates, receives, maintains, or transmits PHI on the vendor’s behalf. This may apply to cloud hosting, analytics, technical support, or other services involving PHI. The agreement—often called a business associate subcontractor agreement—must impose applicable HIPAA protections and flow the required obligations down the chain.

The provider’s BAA should require the vendor to protect PHI handled by its subcontractors and to ensure those subcontractors make the required commitments. Under HIPAA, the vendor—not the covered entity—must obtain the required assurances from its business associate subcontractors. See HHS guidance on business associates and subcontractors.

What are the risks of using software without a required BAA?

If a provider allows a business associate to handle PHI without the required written assurances, the provider may fail to meet HIPAA’s business associate requirements. Without a BAA, the parties may also lack clear, enforceable terms for permitted uses and disclosures, HIPAA Security Rule safeguards, subcontractor protections, and incident cooperation.

Business associates have direct obligations under the HIPAA Rules, including requirements concerning PHI uses and disclosures, safeguards, and breach notification. If a breach of unsecured PHI occurs, the business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery; the covered entity remains responsible for applicable notifications unless it delegates them. See HHS’s Breach Notification Rule guidance.

The absence of a BAA does not, by itself, mean a reportable breach occurred; breach notification depends on the facts and applicable HIPAA rules. But if the vendor handles PHI for the provider, the provider should resolve the agreement gap before continuing that arrangement. Bottom line: determine whether the vendor handles identifiable health information on the provider’s behalf, then put the required BAA and subcontractor protections in place before PHI is shared.

FAQs

Does a geriatric assessment software vendor need a BAA if it stores PHI?

Generally, yes, if the vendor stores PHI on behalf of a HIPAA covered entity or business associate. A vendor may qualify as a business associate even if it stores only encrypted PHI or cannot view the information. See HHS cloud computing guidance.

Is a BAA required when patients use software to access their own health information?

Not necessarily. An app that only facilitates access at the individual’s request does not become a business associate for that reason alone. A BAA may be required if the provider arranges or provides the app, or the app performs a service involving PHI on the provider’s behalf. See HHS guidance on apps selected by individuals.

What responsibilities should a BAA assign for security incidents and breaches?

The BAA must require the business associate to report security incidents it becomes aware of and breaches of unsecured PHI as required by HIPAA. It should specify how and how quickly the vendor reports incidents, what details it provides, and whether it will assist with or perform notifications on the provider’s behalf. For breaches of unsecured PHI, HIPAA requires the business associate to notify the covered entity without unreasonable delay and no later than 60 days after discovery. See HHS’s sample BAA provisions and breach notification guidance.

Do software vendors need BAAs with subcontractors that handle PHI?

Yes. A business associate must obtain written assurances from subcontractors that handle PHI on its behalf and require applicable protections to flow down. This includes subcontractors that create, receive, maintain, or transmit electronic PHI for the vendor. See HHS guidance on business associate subcontractors.