Does Skeletal Survey Imaging Software Need a BAA?

Skeletal survey imaging software needs a HIPAA business associate agreement (BAA) when its vendor handles identifiable patient images or related records on behalf of a covered entity as part of providing the service. The key questions are whether the information is protected health information (PHI) and whether the vendor creates, receives, maintains, or transmits it for the provider.

For HIPAA purposes, electronic PHI (ePHI) is PHI handled electronically. A vendor’s ability to view images is one clue, but storage, transmission, troubleshooting access, and other service functions can also establish a business associate relationship. HHS guidance on software vendors and business associate status explains that hosting patient information or accessing it to troubleshoot software can require a BAA.

When Does Skeletal Survey Imaging Software Require a BAA?

A BAA is generally required when a software vendor performs a service for a covered entity—such as a qualifying health care provider—and that service involves the vendor creating, receiving, maintaining, or transmitting PHI on the provider’s behalf. For example, a vendor may be a HIPAA business associate if it hosts patient-linked skeletal survey images, provides remote support that requires access to those images, or processes them as part of the provider’s workflow.

Access does not have to mean that a vendor employee routinely opens an image. A vendor that maintains ePHI for a provider may be a business associate even if the provider controls who can view it. The provider should assess the actual service and data flows, including vendor support and any subcontractors. HHS cloud-computing guidance explains that a service provider maintaining ePHI on behalf of a covered entity can be a business associate.

How Does Cloud-Based Imaging Software Handle ePHI?

Cloud software may store images, patient identifiers, reports, and related records on servers managed by the vendor or its cloud subcontractors. If the cloud service creates, receives, maintains, or transmits ePHI on behalf of the provider, the provider generally needs a BAA with the service provider before using the service for that ePHI.

Encryption alone does not remove the BAA requirement. HHS states that a cloud service provider can be a business associate even when it stores only encrypted ePHI and does not possess the encryption key. The parties should also understand their respective security duties, including access controls, backups, incident response, and how data will be returned or handled when the service ends. HHS guidance on cloud services and ePHI addresses BAAs, risk analysis, and shared security responsibilities.

When Is a BAA Not Required for Imaging Software?

A BAA is generally not required when a vendor only sells or supplies software and does not access or otherwise handle the provider’s PHI on the provider’s behalf. For example, a locally installed application may fall outside the business associate relationship if the provider operates it and the vendor has no access to patient information. Review the arrangement carefully if the vendor can provide remote troubleshooting, updates, hosting, backups, or other support involving PHI. HHS’s software-vendor FAQ distinguishes software sales without PHI access from services involving access.

A BAA may also be unnecessary when information has been properly de-identified under HIPAA, or when a person’s access to PHI is only incidental to a service that does not involve using or disclosing PHI. The narrow conduit exception may apply to organizations that merely transmit PHI, with only temporary storage as needed for transmission; it does not generally cover a service that stores or processes ePHI. HHS business associate guidance describes these exceptions.

What Must a HIPAA Business Associate Agreement Include?

A BAA must set the boundaries for the vendor’s permitted uses and disclosures of PHI and require the vendor not to use or disclose it beyond what the agreement permits or the law requires. It must also require appropriate safeguards and set out relevant obligations when the vendor performs Privacy Rule duties for the provider. HHS’s sample business associate agreement provisions provide examples of required terms.

For imaging software, the agreement should address the parties’ practical responsibilities, including:

• Safeguarding ePHI under the HIPAA Security Rule and limiting its use and disclosure to permitted purposes.
• Requiring subcontractors that handle ePHI to accept applicable privacy and security obligations.
• Security incident reporting and notice of breaches of unsecured PHI.
• Helping the provider meet applicable obligations concerning access, amendment, and accounting of disclosures.
• Making relevant records available to HHS for compliance review.
• Returning or destroying PHI when the agreement ends, if feasible, and addressing any PHI that cannot feasibly be returned or destroyed.

The contract should make responsibilities clear for the specific software setup. For example, it can describe who controls user access, how incidents are reported, how ePHI is exported, and what happens to backups after termination.

What HIPAA Responsibilities Remain With the Provider?

Signing a BAA does not transfer all HIPAA responsibilities to the vendor. The provider remains responsible for its own compliance, including conducting a HIPAA risk analysis covering the ePHI it creates, receives, maintains, or transmits; managing identified risks; and selecting and configuring the service in a way that fits its security needs. HHS states that covered entities and business associates must conduct risk analyses. HHS cloud-service guidance discusses the provider’s continuing risk analysis obligations.

The provider should also apply its own access controls, train its workforce on applicable requirements and employer-specific policies, and have procedures for responding to incidents and meeting its obligations under HIPAA. A BAA documents the vendor’s commitments; it does not by itself establish that either party has complied with every HIPAA requirement. The HHS Security Rule risk analysis guidance explains that risk analysis and risk management are ongoing compliance activities.

Does the Treatment Disclosure Exception Apply to Imaging Software?

HIPAA permits a covered entity to disclose PHI to a health care provider for treatment without requiring a BAA between those providers. For instance, a provider may send patient information to another provider who needs it to treat the patient. HHS guidance on treatment disclosures between providers describes this exception.

That exception does not automatically cover an imaging software vendor. A vendor providing software or hosting services on behalf of a provider is not necessarily a health care provider receiving information to treat the individual. If the vendor handles ePHI to deliver its service, the provider generally needs a BAA even when the software supports clinical treatment. The treatment exception concerns the qualifying disclosure to a health care provider; it does not erase a separate business associate relationship.

In short, determine whether patient-linked images are ePHI, whether the vendor handles them on the provider’s behalf, and which parties control each security task. If the vendor is a business associate, put a BAA in place and continue the provider’s own HIPAA risk analysis and safeguards.

FAQs

Does a skeletal survey imaging vendor need a BAA if it can access patient images?

Generally, yes, if the vendor accesses identifiable patient images to provide a service on behalf of the covered entity, such as hosting or troubleshooting the software. HHS identifies software vendors that host patient information or access it for troubleshooting as examples where a BAA is required. If access is only incidental to a service that does not involve PHI, the facts may differ.

Is a BAA required when skeletal survey imaging software stores ePHI in the cloud?

Generally, yes, when the cloud service stores ePHI on behalf of the provider. A BAA may be required even if the data is encrypted and the cloud provider does not hold the encryption key. The provider should also assess its own cloud-related risks and security responsibilities.

Does a provider still need a HIPAA risk analysis after signing a BAA?

Yes. A BAA does not replace the provider’s HIPAA risk analysis. The provider must assess risks to the ePHI it creates, receives, maintains, or transmits and manage the risks it identifies.

Does the HIPAA treatment exception eliminate the need for a BAA with an imaging software vendor?

Not by itself. The treatment exception allows certain disclosures to health care providers for treatment without a BAA between those providers. It does not generally eliminate the need for a BAA when a software vendor handles ePHI on the provider’s behalf.