EHR Data Migration Vendor BAA Checklist: Key HIPAA Requirements

An EHR migration vendor that creates, receives, maintains, or transmits protected health information (PHI) for a HIPAA-covered organization will generally be a business associate. Before migration begins, use the HIPAA Business Associate Agreement (BAA) to define permitted data handling, safeguards, reporting, subcontractor controls, and what happens to PHI when the work ends.

HIPAA sets contractual and security requirements, but it does not prescribe every migration detail. Treat file formats, testing, access controls, and project records as items to specify clearly in the agreement and migration plan.

When must an EHR migration vendor BAA be signed and what should it cover?

Put a written BAA in place before the vendor receives or accesses PHI for the migration. HIPAA allows a covered entity to disclose PHI to a business associate when it obtains satisfactory assurances—typically through a contract—that the business associate will safeguard the information and follow the agreement’s limits. HHS guidance on business associates

The agreement should define the migration services and the PHI the vendor may handle, including whether it may create, receive, maintain, or transmit electronic PHI (ePHI). It should also specify permitted uses and disclosures, require appropriate safeguards, require incident reporting, address subcontractors, and provide for return or destruction of PHI at termination when feasible. HHS sample business associate agreement provisions

Include cooperation duties for individual access, amendments, and accounting requests when relevant to the service, as well as access to records for HHS compliance review. The BAA should authorize termination for a material breach. These are contractual requirements, not a certification that either party is automatically HIPAA-compliant.

Which HIPAA safeguards should the agreement require?

Require the vendor to comply with the applicable Security Rule requirements for ePHI and describe safeguards appropriate to the migration’s risks. HIPAA requires a risk analysis and risk management, security-incident procedures, workforce access controls, information-system activity review, and contingency planning, among other measures. HHS summary of the HIPAA Security Rule

For a migration, translate those requirements into practical commitments: approved transfer methods, safeguards for temporary and staging environments, access logging, backup and recovery procedures, workforce training, and prompt removal of access when a worker no longer needs it. Specify how the vendor will protect PHI while it is being transferred and stored.

Address electronic PHI encryption explicitly. The Security Rule lists encryption and decryption as an “addressable” implementation specification—not a blanket requirement to use a particular encryption method in every circumstance. The organization must assess whether the specification is reasonable and appropriate in its environment and document its decision, including any equivalent alternative measure when encryption is not implemented. 45 CFR § 164.312

How should vendor and subcontractor access to PHI be limited?

Define which vendor roles need access, what records or fields they may handle, and when access starts and ends. Use named accounts, role-based permissions, time-limited access, and activity logging as contract requirements where appropriate. These controls help align access with the migration task and the organization’s applicable minimum necessary policies.

The minimum necessary standard generally calls for reasonable efforts to limit PHI use, disclosure, and requests to what is needed for the purpose; HIPAA includes exceptions, including certain disclosures for treatment. Define the migration scope with the vendor rather than assuming that every worker needs access to an entire record set. HHS minimum necessary guidance

Require the vendor to identify subcontractors that may handle PHI, describe their roles, and obtain the required written assurances from each before PHI is disclosed to them. Those agreements must apply the relevant restrictions and conditions to the subcontractor. Specify how the vendor will manage subcontractor access, report changes in its subcontractor chain, and ensure access is removed when the work ends. HHS business associate guidance on subcontractors

What should the BAA specify for security incident and breach reporting?

Require the vendor to report security incidents and impermissible uses or disclosures of PHI, not just incidents ultimately determined to be reportable breaches. The Security Rule requires business associates to report security incidents, while the agreement can specify the reporting format and level of detail. HHS guidance on security-incident reporting

Set a short contractual deadline for initial notice of a suspected incident, with a clear contact method and after-hours escalation process. HIPAA does not set one universal deadline for reporting every security incident. For a breach of unsecured PHI, however, a business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. The BAA can require a faster report so the organization has time to assess the event and meet its own obligations. 45 CFR § 164.410 HHS guidance on BAA reporting terms

Specify what the vendor must provide as facts become available: the incident’s nature and timing, PHI and people potentially affected, containment steps, investigation updates, and cooperation with risk assessment and required notifications. State whether the vendor may contact affected individuals or regulators only when the covered entity delegates that task in writing.

How should PHI be returned or destroyed when migration services end?

Specify how the vendor will return PHI in an agreed usable format and, when feasible, destroy the PHI it still maintains at termination. The BAA must require return or destruction when feasible; if neither is feasible, the vendor must continue protecting the PHI and limit further use and disclosure to the purposes that make return or destruction infeasible. 45 CFR § 164.504(e)(2)(J)

Define how the vendor will handle working copies, temporary files, staging systems, removable media, and backups. Set a deletion deadline, require written confirmation of completed destruction, and require the vendor to explain any retained PHI, the reason it cannot be returned or destroyed, who can access it, and when it will be deleted. Do not assume HIPAA requires a vendor to retain ePHI after its services end. HHS guidance on retaining ePHI after services end

What should the migration plan cover for formats, conversion, and legacy access?

HIPAA does not specify a particular EHR migration file format or conversion method. Document the source and destination systems, the records in scope, agreed export and import formats, field mappings, and any transformations the vendor will perform. Identify how the team will flag unsupported data, conversion errors, duplicates, and records that require manual review.

Set out how the parties will validate the transfer. For example, agree on record counts, sample-record review, checks for missing or altered data, exception reports, and written acceptance criteria. Define who can approve mappings or resolve exceptions, and how the team will pause, correct, or roll back a transfer if validation fails.

Plan for continuity during cutover, including downtime communications and a fallback process. Specify how long the legacy system will remain available, who can access it, and how staff will retrieve records needed for care or other obligations. HHS states that a covered entity remains responsible for ensuring the availability of its own PHI, including PHI maintained by a business associate. HHS guidance on access to PHI held by a business associate

What documentation should organizations retain?

Keep the signed BAA and amendments, the migration scope, approved access lists, subcontractor information, incident notices, data-return or destruction confirmation, and evidence of testing and acceptance. These project records can help the organization show what was agreed, how the transfer was controlled, and whether issues were addressed; not every item on this list is a separate HIPAA-mandated record.

For documentation that the Security Rule requires, the organization must retain it for six years from the date of creation or the date it was last in effect, whichever is later. This retention rule applies to required Security Rule documentation; it does not automatically make every migration artifact subject to the same period. HHS Security Rule documentation guidance

In short, a strong migration arrangement combines a BAA that sets enforceable PHI protections with a migration plan that defines access, transfer, validation, continuity, and secure closeout.

FAQs

Should an EHR data migration vendor sign a BAA before receiving PHI?

Yes, when the vendor will act as a business associate by handling PHI for the covered entity, put the written BAA in place before it receives or accesses PHI for the work. The agreement documents the required assurances and limits on the vendor’s handling of the information. HHS business associate guidance

What breach reporting timelines should an EHR migration vendor BAA specify?

Specify prompt initial reporting for suspected security incidents and a deadline for updates as the facts develop. For a breach of unsecured PHI, federal HIPAA rules require notice to the covered entity without unreasonable delay and no later than 60 calendar days after discovery; the BAA may set a shorter deadline. 45 CFR § 164.410

Can a vendor retain PHI after migration is complete?

The BAA must require the vendor to return or destroy PHI at termination when feasible. If return or destruction is infeasible, the vendor must continue protecting the PHI and restrict its use and disclosure to the purposes that make return or destruction infeasible. Spell out any permitted retention, access restrictions, and eventual deletion in the agreement. 45 CFR § 164.504(e)(2)(J)

How should a BAA address subcontractors handling PHI?

Require the vendor to identify subcontractors that will handle PHI and obtain written agreements imposing the applicable PHI restrictions and conditions before disclosing PHI to them. The BAA should also describe how the vendor will manage subcontractor access and report changes in subcontractors. HHS business associate guidance