HIPAA BAA Checklist: What to Review Before Connecting a Patient Engagement SMS Platform to Your EHR

• Validate inputs: main keyword, related keywords, and the exact content outline.
• Structure strictly by the provided H1 and H2 headings, in order.
• Write clear, in-depth content for each section using the exact headings.
• Integrate the main keyword and related keywords naturally throughout.
• Place the provided FAQs under a final H2 titled FAQs.
• Conclude with a concise summary of takeaways before the FAQs.
• Return clean HTML only, with semantic elements and no external links.

BAA Requirements

Your Business Associate Agreement is the legal foundation enabling a vendor to create, receive, maintain, or transmit Protected Health Information while preserving HIPAA Compliance. Confirm that the BAA precisely describes services, data flows, and the scope of PHI processed via the SMS platform and your EHR.

Core clauses to confirm

• Permitted uses and disclosures: strictly aligned to treatment, payment, and healthcare operations; prohibit secondary uses without authorization.
• Minimum necessary: explicit commitment to limit PHI use, disclosure, and access to the minimum necessary.
• Safeguards: administrative, physical, and technical controls consistent with Data Encryption Standards and access controls.
• Breach and incident notification: prompt reporting timelines, required details, and cooperation duties.
• Subcontractor BAA Obligations: flow-down requirements ensuring every subcontractor with PHI also signs and meets equivalent protections.
• Right to audit and assessments: your ability to review controls and receive audit summaries.
• Termination, data return/destruction: clear procedures, secure deletion, and certified destruction when appropriate.

Evidence to obtain

• Executed BAA with all addenda and service descriptions.
• Security program overview (policies, risk management, training, incident response).
• Attestation or reports (e.g., SOC 2 Type II, HITRUST) demonstrating ongoing compliance controls.

Vendor Evaluation

Beyond the BAA, evaluate the vendor’s maturity and operational readiness to handle PHI at scale. A strong security and delivery posture reduces integration and compliance risk.

• Security governance: documented policies, annual risk assessments, workforce training, access reviews, and vendor risk management.
• Certifications and attestations: recent SOC 2 Type II, HITRUST, or ISO 27001 mapping to HIPAA safeguards.
• Resilience: disaster recovery, RPO/RTO targets, tested backups, and multi-region availability.
• Deliverability and compliance: carrier registration, throughput management, and controls to prevent PHI leakage in message bodies.
• Product fit: native HL7/FHIR connectors, EHR-specific adapters, secure webhooks, role-based access, and robust admin tooling.
• Support and SLAs: defined response times, escalation paths, and named technical contacts.

Data Encryption

Encryption must protect PHI at rest and in transit within systems under your and the vendor’s control. Because standard SMS is not end-to-end encrypted, design to avoid including PHI in message content.

In transit

• TLS 1.2+ for APIs, mTLS for high-trust integrations, and HMAC-signed webhooks to your EHR endpoints.
• VPN or private connectivity options when available to reduce exposure.

At rest and key management

• AES-256 encryption at rest with FIPS-validated modules; encrypted backups and snapshots.
• Centralized KMS/HSM, key rotation, separation of duties, and restricted key access.

SMS-specific safeguards

• Avoid PHI in message bodies; use tokenized, time-limited links to a secure portal instead.
• Content scanning to block prohibited data elements; configurable templates to enforce safe language.

Audit Logs

Robust audit trails demonstrate accountability and support investigations. Define Audit Trail Requirements that cover user activity, data access, and message events.

• Events: login, permission changes, API calls, PHI access, consent updates, message creation/sending/delivery status, and configuration edits.
• Integrity: immutable, tamper-evident logs with synchronized timestamps and retention aligned to policy.
• Usability: searchable UI, export to SIEM, and APIs for automated reviews and alerts.
• Monitoring: anomaly detection (e.g., spikes in lookups, bulk exports, or template changes).

Consent Management

Patient Consent Management must capture, store, and honor consent and opt-out states across systems. Align with HIPAA rules and applicable messaging laws.

• Capture: record consent context (purpose, channel, timestamp, source, language) and any written authorizations for marketing.
• Sync: write consent status back to the EHR and prevent sends when consent is revoked.
• Operate: automatic processing of STOP/HELP keywords, multilingual messages, and accessibility considerations.
• Evidence: auditable history of consent changes plus reporting for compliance reviews.
• Guardrails: template controls to avoid PHI unless proper authorization is documented.

Minimum Necessary Rule

Design workflows so people, systems, and messages see only what they need. This protects patients and reduces breach impact.

• Message design: exclude diagnoses, test names, or specifics; use neutral phrasing and secure links for details.
• Access control: role-based permissions, least-privilege defaults, and periodic access reviews.
• Data handling: field-level masking, redaction in logs, and minimized caching within the SMS platform.
• Process controls: template approvals, peer review for new campaigns, and automated scanning to flag sensitive terms.

Vendor Subcontractors

Map every downstream entity that can touch PHI, including CPaaS providers and managed service partners. Your vendor must extend protections through Subcontractor BAA Obligations.

• Flow-down: ensure BAAs with subcontractors mirror security, breach, and audit provisions.
• Data map: document where PHI flows, which services handle content, and what is stored versus transient.
• Oversight: require due diligence artifacts, incident notification paths, and the right to review controls.
• Access minimization: technical and contractual limits on subcontractor access to content and keys.

Data Storage Location

Confirm where data and backups reside and how data traverses networks. Align storage and processing with policy and patient expectations.

• Residency: primary and backup regions (often U.S.) and options to pin data to specific regions.
• Retention: message content, metadata, and logs retained only as long as necessary; documented deletion procedures.
• Transit awareness: carriers may route internationally; mitigate by excluding PHI from SMS content and encrypting platform-to-platform traffic.
• Backups and recovery: encrypted, tested restores, and documented restoration timelines.

Integration Testing

Thorough testing validates privacy controls and reliability before go-live. Use de-identified data whenever possible.

• Functional: HL7/FHIR mapping, patient matching, consent checks, and idempotent retries to prevent duplicates.
• Security: mTLS, webhook signature verification, least-privilege API keys, and secret rotation.
• Content safety: template enforcement and automated PHI scanners blocking unsafe payloads.
• Reliability: delivery receipts, failure handling, backoff policies, and recovery from EHR downtime.
• Performance: load tests for peak volumes, queue depth monitoring, and alerting thresholds.
• Acceptance: go/no-go criteria covering deliverability, logging, consent synchronization, and access controls.

Ongoing Compliance Monitoring

Compliance is continuous. Establish metrics, reviews, and accountability to sustain protections after launch.

• Governance: quarterly risk reviews, policy updates, and access recertification.
• Testing: scheduled vulnerability scans, penetration tests, and remediation tracking.
• Operational health: SLA adherence, incident drills, post-incident reports, and vendor scorecards.
• Change management: review new templates, integrations, and configuration drift before deployment.
• Reporting: periodic Audit Trail Requirements review, consent trend analysis, and deletion/retention attestations.

Conclusion

This HIPAA BAA Checklist helps you connect an SMS platform to your EHR without exposing PHI. Lock down your BAA, vet vendors, encrypt data, log everything, require explicit consent, enforce the Minimum Necessary Rule, control subcontractors, govern storage, test deeply, and monitor continuously.

FAQs

What is a Business Associate Agreement and why is it required?

A Business Associate Agreement is a contract that allows a service provider to handle Protected Health Information on your behalf while committing to HIPAA Compliance. It defines permitted uses of PHI, required safeguards, breach reporting duties, subcontractor obligations, and how data is returned or destroyed at termination.

How can I verify an SMS platform’s HIPAA compliance?

Request a signed BAA, a current security overview, and recent attestations such as SOC 2 Type II or HITRUST mapping to HIPAA safeguards. Validate technical controls during integration testing—encryption, access controls, signed webhooks, audit logs—and confirm ongoing practices like risk assessments and incident response.

What data encryption methods protect PHI in SMS platforms?

Use TLS 1.2+ (preferably with mutual TLS) for data in transit and AES-256 with FIPS-validated modules for data at rest, including backups. Because SMS itself is not end-to-end encrypted, avoid putting PHI in message bodies; instead, send tokenized, time-limited links to secure portals where PHI is encrypted and access-controlled.

How do I ensure patient consent for SMS communications?

Capture and store consent with context (purpose, timestamp, source), synchronize status with the EHR, and automatically enforce opt-outs. For any marketing content, obtain written authorization before sending. Maintain an auditable history of consent changes and use templates that prevent PHI from appearing in SMS messages unless proper authorization exists.