Healthcare Chatbot Developer BAA Checklist: What to Include

A healthcare chatbot may process patient messages, appointment details, symptoms, and other protected health information (PHI). If its developer handles that information on behalf of a healthcare provider or another business associate, a carefully scoped HIPAA Business Associate Agreement (BAA) is an essential part of the arrangement.

Use this checklist to define the chatbot developer’s permitted activities, safeguards, reporting duties, and responsibilities for patient requests and PHI at termination. Distinguish HIPAA requirements from additional contract terms you negotiate to fit your organization’s risks.

When does a healthcare chatbot developer qualify as a business associate?

A developer generally qualifies as a business associate when it performs a service for a covered entity—or for another business associate—and creates, receives, maintains, or transmits PHI on their behalf. For example, HHS identifies a third-party chatbot on a provider’s patient portal that handles PHI for symptom assessments, medical reminders, or appointment scheduling as a potential business associate. See HHS guidance on business associates.

Look at what the chatbot and its related services actually do, rather than relying on labels such as “AI tool,” “software vendor,” or “platform.” Consider the full data flow: whether the developer receives patient messages, operates the model, stores transcripts, maintains logs or backups, or provides support that involves access to PHI. A cloud provider can be a business associate even if it stores only encrypted ePHI and cannot decrypt it, according to HHS cloud-computing guidance.

Not every app developer is automatically a business associate. HHS distinguishes services provided on a covered entity’s behalf from an app that an individual independently chooses to receive their own information. Confirm the parties’ roles and data flows before PHI is shared; if the developer is acting as a business associate, put the required agreement in place before the arrangement handles PHI.

Define permitted uses and disclosures of PHI

Describe the chatbot services the developer may perform and the PHI uses and disclosures needed for those services. Be specific about patient prompts and responses, transcripts, identifiers, conversation metadata, logs, support records, and outputs that contain PHI. The BAA should prohibit other uses or disclosures unless the agreement permits them or law requires them.

Address AI-related uses directly. For example, state whether the developer may use PHI to operate the chatbot, troubleshoot errors, conduct security monitoring, or improve a model. If model training, analytics, or product improvement is not authorized, say so clearly and prohibit using PHI for those purposes. Specify any approved data sharing, retention, or de-identification process rather than relying on general language about “service improvement.”

HIPAA requires a BAA to describe permitted and required uses and disclosures and to restrict other uses and disclosures. It cannot authorize conduct that would violate the Privacy Rule if performed by the covered entity. Review HHS sample BAA provisions when drafting these terms.

Require safeguards for PHI and electronic protected health information

Require the developer to protect PHI against unauthorized use or disclosure and to comply with applicable HIPAA Security Rule requirements for electronic protected health information (ePHI). The HIPAA Security Rule calls for appropriate administrative, physical, and technical safeguards to protect ePHI’s confidentiality, integrity, and availability. See HHS’s overview of the Security Rule.

Make the obligations concrete for the chatbot’s systems and service providers. Depending on your risk assessment and negotiated terms, address unique user accounts, role-based access, authentication, audit logging, workforce training, incident response, backup and recovery, secure transmission, and encryption. Require the developer to manage access to prompts, transcripts, model inputs and outputs, support tools, and any environments where PHI may be stored or processed.

Ask the developer to explain how its safeguards cover the complete service, including cloud hosting, model providers, monitoring tools, and support operations. HHS describes risk analysis as identifying risks and vulnerabilities to ePHI and risk management as implementing measures to reduce those risks. A contract can require evidence of controls or assessment results, but HHS notes that the HIPAA Rules do not expressly require a cloud service provider to give customers security documentation or permit customer audits; these can be negotiated as additional assurances. See HHS guidance on risk analysis and risk management and its cloud-provider documentation and audit FAQ.

Set incident and breach reporting requirements

Require the developer to report uses or disclosures not allowed by the BAA and security incidents involving the chatbot service. Define whom to contact, how to report, what details to include, and how the developer will provide updates and cooperate with investigation, containment, mitigation, and required notices. Include suspected incidents as well as confirmed incidents if that is the reporting threshold you negotiate.

Keep the contractual deadlines clear. For a breach of unsecured PHI, HIPAA requires a business associate to notify the covered entity without unreasonable delay and no later than 60 days after discovery. That is a federal outside limit for this breach notification duty, not a recommended response target for every incident. A BAA can set a shorter reporting deadline to give the covered entity time to investigate and meet its own responsibilities. HHS explains the breach notification requirements in its Breach Notification Rule guidance.

Specify that breach reports include, as available, affected individuals, the types of PHI involved, discovery details, and steps taken or planned to address the event. HIPAA requires the business associate to provide identifying information about affected individuals to the extent possible and other available information the covered entity needs for its notification.

Address access requests, amendments, and disclosure accounting

State how the developer will help the covered entity respond to individual access requests involving PHI the chatbot holds. The BAA should require the developer to make relevant PHI available for access requests, make it available for amendments, and provide information needed for an accounting of disclosures. It may specify whether the developer sends information to the covered entity or handles requests directly on the covered entity’s behalf.

Set an operational process for routing requests, verifying their scope with the covered entity, locating records across relevant systems, and returning information in a usable format. The covered entity remains responsible for applicable Privacy Rule duties, and delays in obtaining data from a developer can consume the covered entity’s response time. For example, HHS says a covered entity generally must act on an access request within 30 calendar days, with a possible one-time extension of up to 30 additional days if it follows the required notice process. See HHS guidance on access-request timing.

For amendments, require the developer to update PHI in its records or copies when instructed by the covered entity. For an accounting of disclosures, require records sufficient to identify disclosures that must be included and make that information available to the covered entity. HHS summarizes these BAA responsibilities in its FAQ on business associates and individual rights.

Apply BAA terms to subcontractors and HHS reviews

Identify the subcontractors that may create, receive, maintain, or transmit PHI for the chatbot service. This may include hosting providers, model or API providers, analytics services, and support vendors. Require the developer to bind each relevant subcontractor to written terms that impose the same applicable restrictions and conditions for PHI before it is disclosed to that subcontractor.

These subcontractor business associate obligations are part of the HIPAA BAA framework. For additional control, negotiate advance notice of new subcontractors, an opportunity to object, a current subcontractor list, and responsibility for subcontractor failures. HHS explains the required flow-down terms in its business associate guidance.

Require the developer to make its internal practices, books, and records relating to PHI available to the Secretary of HHS for purposes of determining the covered entity’s compliance with the HIPAA Privacy Rule. The agreement can also set practical procedures for cooperation with an HHS request, including prompt notice to the covered entity where legally permitted and preservation of relevant records. See HHS sample BAA provisions.

Specify termination rights and PHI return or destruction

Authorize the covered entity to terminate the BAA if the developer violates a material term. Define any notice and cure process, while preserving the ability to act when a violation cannot be cured or continued access creates unacceptable risk.

At termination, require the developer to return or destroy PHI received from the covered entity or created, maintained, or received on its behalf, if feasible. Address copies held by subcontractors, backups, logs, and other service records. If return or destruction is infeasible, the BAA must extend its protections to the retained PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible. See HHS guidance on PHI retention after services end.

Plan for an orderly transition: specify the return format, transfer deadline, deletion confirmation, treatment of legally required retention, and continued access needed to preserve PHI availability. HHS warns that a business associate generally may not block a covered entity’s access to PHI it maintains on the entity’s behalf. Together, clear use limits, safeguards, incident reporting, individual-rights support, subcontractor terms, and exit procedures form the core of a practical healthcare chatbot BAA checklist.

FAQs

When is a healthcare chatbot developer a business associate?

A developer is generally a business associate when it creates, receives, maintains, or transmits PHI on behalf of a covered entity or another business associate. A chatbot that handles patient PHI for a provider’s portal may meet this test; the parties’ actual roles and data flows matter.

What PHI uses and disclosures should a chatbot BAA permit?

Permit only the uses and disclosures needed for the specified chatbot services, such as processing patient conversations or providing authorized support. Address transcripts, logs, model inputs and outputs, subcontractor access, and any proposed analytics or model training. Prohibit uses not expressly authorized by the agreement or required by law.

What incident reporting obligations should a chatbot BAA include?

Require reporting of unauthorized uses or disclosures and security incidents, with a clear contact, reporting method, deadline, and follow-up process. For a breach of unsecured PHI, federal HIPAA rules require notice without unreasonable delay and no later than 60 days after discovery; the BAA can set a shorter deadline.

What should happen to PHI when the BAA terminates?

The BAA should require the developer to return or destroy PHI when feasible, including PHI held by relevant subcontractors. If return or destruction is infeasible, the developer must continue protecting the retained PHI and limit further uses and disclosures to the purposes that make the return or destruction infeasible.