Eligibility Verification Clearinghouse Business Associate Agreement Checklist

An eligibility verification clearinghouse may create, receive, maintain, or transmit protected health information (PHI) on a provider’s behalf. A well-drafted business associate agreement (BAA) should define those activities, set practical safeguards, and explain how the parties will authorize and route eligibility inquiries and responses.

Which permitted uses and disclosures of PHI should the agreement specify?

Describe the clearinghouse’s contracted role in concrete terms: receiving eligibility inquiries, preparing or transmitting standard transactions, receiving responses, returning them to the provider, and retaining transaction records only as agreed. The BAA should state that the clearinghouse may use or disclose PHI only as permitted by the agreement or required by law—not for unrelated purposes such as marketing or independent profiling. These are core requirements of 45 CFR § 164.504(e).

Specify any separately permitted use, such as proper management and administration, with its limits and safeguards. Identify who may receive PHI, for what purpose, and under what conditions. A BAA does not itself authorize a use or disclosure that HIPAA otherwise requires to be authorized; the parties must assess the applicable basis for the disclosure. HIPAA generally permits covered entities to use or disclose PHI for payment activities, subject to other applicable requirements, as explained in 45 CFR § 164.506.

What HIPAA safeguards and security requirements should the clearinghouse meet?

Require the clearinghouse to comply with applicable requirements of the HIPAA Security Rule and to use appropriate safeguards against unauthorized use or disclosure of PHI. For electronic PHI, the agreement should address administrative, physical, and technical protections in proportion to the systems and risks involved. The Security Rule requires a documented risk analysis and risk management measures; it also requires policies for access, security incident response, and system activity review. See 45 CFR § 164.308 and the technical safeguards provisions.

Turn those requirements into operational commitments: limit workforce access by role, promptly revoke access when it is no longer needed, protect data in transit and at rest according to the parties’ risk-based security standards, maintain appropriate audit records, and test recovery procedures. Identify security contacts and describe how the provider can obtain relevant incident, risk, or assurance information. These contract details help make the HIPAA Privacy Rule and HIPAA Security Rule requirements workable; they should not be presented as a guarantee of compliance.

How should breaches and security incidents be reported?

Require prompt notice of any use or disclosure not allowed by the BAA and any security incident the clearinghouse becomes aware of. Define where and how to report, which contact must receive the notice, and what initial facts should be included. A security incident can include attempted as well as successful unauthorized access or interference with systems, so the agreement can distinguish routine unsuccessful attempts from incidents that may affect PHI and set appropriate reporting procedures.

For a breach of unsecured PHI, federal law requires a business associate to notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. The notice must include available information needed for the covered entity’s notifications, including identification of affected individuals to the extent possible. A BAA may establish a shorter operational deadline; it should not extend or replace the federal requirements. See 45 CFR § 164.410 and the HHS Breach Notification Rule guidance.

What obligations apply to subcontractors handling PHI?

Identify the types of subcontractors that may handle PHI, such as hosting, support, or transaction-processing vendors. The BAA should require the clearinghouse to ensure that each business associate subcontractor that creates, receives, maintains, or transmits PHI agrees in writing to the same applicable restrictions and conditions that bind the clearinghouse. This downstream obligation is part of 45 CFR § 164.504(e).

As a practical contract measure, require advance notice of material subcontractor changes, disclose each subcontractor’s role, and establish a process for addressing a subcontractor’s failure to protect PHI. If the clearinghouse knows of a pattern or practice by a subcontractor that materially violates its obligations, HIPAA requires reasonable steps to cure the problem or end the violation and, if those steps fail, termination where feasible.

How should the clearinghouse support individual rights and compliance reviews?

Require the clearinghouse to make PHI available to the provider as needed to respond to individual requests for access, amendments, and an accounting of disclosures. Specify practical response times, secure delivery methods, and the information the clearinghouse must preserve or provide. The BAA must address these support duties under 45 CFR § 164.504(e); the relevant individual-rights provisions include access, amendment, and accounting of disclosures.

If the clearinghouse performs a provider’s Privacy Rule obligation, the agreement should require it to follow the requirements that apply to that function. It must also make relevant internal practices, books, and records available to the Secretary of HHS for compliance review. A provider can specify reasonable cooperation procedures without implying that HIPAA universally requires routine audits of every business associate.

What should happen to PHI when the agreement ends?

State that, when the BAA terminates, the clearinghouse must return or destroy PHI received from or created on the provider’s behalf, if feasible, and retain no copies. If return or destruction is infeasible, the BAA must extend the agreement’s protections to the retained PHI and limit further uses and disclosures to the purposes that make deletion or return infeasible. These are the termination requirements in 45 CFR § 164.504(e)(2)(J).

For clarity, address data in backups, archives, and subcontractor systems; the method and timing of return or destruction; and written confirmation when the work is complete. These are useful contract details, not a substitute for the rule’s exception when return or destruction is genuinely infeasible. In that case, protections continue to apply to the retained information.

How should eligibility inquiries be authorized, identified, routed, and enrolled?

Define how the provider appoints the clearinghouse to act on its behalf, how that authority is documented, and which staff, systems, and submitter identifiers may initiate inquiries. Set a process to verify the provider and submitter relationship before sending an inquiry, validate that the request relates to an appropriate patient and business purpose, and prevent use of provider credentials by unauthorized parties. The BAA documents the business associate relationship, but it does not replace payer-specific trading-partner terms, enrollment, or other access requirements.

For Medicare HETS, CMS requires submitters to establish provider authentication outside the 270 eligibility transaction and says clearinghouses must be able to associate each inquiry with a provider. CMS also states that submitters must not send user IDs and passwords within the 270 transaction. Review the current CMS HETS connection requirements and HETS information; these are program-specific requirements, not a universal description of every payer’s enrollment process.

Contract for a reliable request-to-response link: preserve transaction identifiers, associate each 271 response with its originating 270 request and provider, and route the response only to the authorized endpoint for that provider or submitter. Use access controls and logging to detect misrouting, and define procedures for correcting or reporting a routing error. CMS describes the 270 and 271 as paired inquiry-and-response transactions in its HETS 270/271 Companion Guide.

In short, a strong agreement connects permitted PHI uses, safeguards, incident response, subcontractor duties, individual-rights support, termination procedures, and transaction-level authorization and routing controls.

FAQs

Can an eligibility verification clearinghouse act as a provider’s authorized agent?

Yes, a provider may engage a clearinghouse as an agent to help perform eligibility verification, provided the parties establish the appropriate business associate relationship when the clearinghouse handles PHI on the provider’s behalf. The provider should document the scope of authority and meet applicable payer enrollment and access rules. For Medicare HETS, CMS describes its system as available to providers and their authorized agents, with submitter and provider authentication requirements. See CMS HETS connection guidance.

What must a business associate agreement require when PHI is handled by subcontractors?

The agreement must require the business associate to ensure that subcontractors handling PHI agree in writing to the same applicable restrictions and conditions that apply to the business associate. The agreement should also establish practical oversight, notice, and remediation procedures. See 45 CFR § 164.504(e).

How should the clearinghouse handle PHI when the agreement terminates?

If feasible, it must return or destroy the PHI and retain no copies. If return or destruction is infeasible, it must continue protecting the PHI under the BAA and limit further use or disclosure to the purposes that make return or destruction infeasible. See 45 CFR § 164.504(e)(2)(J).

How can a provider ensure eligibility responses are routed only to the originating submitter?

Require transaction identifiers that link each response to its request, provider, and authorized submitter; restrict response endpoints to authenticated destinations; and maintain logs and exception procedures for misrouted or unmatched responses. For Medicare HETS, CMS specifically requires clearinghouses to associate inquiries with providers; review the CMS HETS connection requirements.