HIPAA-Compliant Vendor Offboarding Policy Template for Health Information Exchanges

What should a health information exchange vendor offboarding policy include?

Use this model as a starting point for offboarding a vendor that creates, receives, maintains, or transmits protected health information (PHI) for a health information exchange (HIE). First identify each party’s HIPAA role: an HIE may act as a business associate, a covered entity, or in another capacity depending on its functions and relationship with the organizations involved. Apply the policy alongside the relevant contract, business associate agreement (BAA), and applicable state or other federal requirements.

Policy statement: When a vendor’s services end, the HIE will coordinate a documented transition that protects PHI, preserves agreed-upon access and availability, returns or destroys PHI when feasible, and revokes vendor access when it is no longer needed.

• Assign responsibilities: Name the HIE contract owner, privacy and security contacts, vendor lead, and any successor vendor responsible for coordinating the transition.
• Set contract-based milestones: Specify the offboarding start date, data-transfer format and method, access-continuity period, return or destruction deadline, and escalation process. HIPAA does not establish one universal offboarding timeline; document the applicable agreement’s deadlines.
• Inventory PHI and access: Identify the systems, data stores, interfaces, user and service accounts, devices, subcontractors, and backup or archive copies associated with the services.
• Plan transfer and continuity: Identify what information must be returned, who will validate it, how the HIE or its authorized users will access it during transition, and how data integrity and usability will be checked.
• Control use during transition: Limit vendor access and use to authorized transition tasks and apply the minimum necessary use and disclosure standard where it applies, subject to HIPAA’s exceptions.
• Close out and retain evidence: Record access revocation, return or destruction outcomes, any retained PHI and its justification, unresolved issues, and the final vendor attestation.

The BAA must address termination and PHI disposition when the vendor is a business associate. The HIPAA Privacy Rule requires the contract to provide for return or destruction of PHI at termination if feasible and to address infeasibility if it is not. See 45 CFR § 164.504(e)(2)(ii)(J).

How should vendors return or destroy PHI at contract termination?

Before terminating service access, reconcile the vendor’s PHI inventory with the HIE’s records and agree on the disposition for each system and data type. The vendor should return the PHI in a format and manner that preserve its accessibility and usability, as specified in the BAA or other governing agreement. The HIE should confirm receipt, completeness, and successful import before authorizing destruction of copies that are due to be destroyed.

Where the agreement permits destruction instead of return, the vendor should securely dispose of paper records and sanitize electronic media using a method appropriate to the information and the media. HIPAA requires policies and procedures for final disposition of ePHI and for removing ePHI before electronic media are reused; it does not prescribe one disposal method for every situation. See 45 CFR § 164.310(d)(2) and HHS guidance on PHI disposal.

For ePHI media sanitization, the organization should select and document a suitable process for the media and circumstances, such as clearing, purging, or destruction. The policy should cover vendor-managed devices, removable media, exports, temporary files, and subcontractor-held copies. For cloud services and backups, identify which copies can be promptly returned or deleted and which may remain temporarily in protected backup cycles.

Request a PHI return and destruction attestation identifying the data covered, disposition method, completion date, relevant exceptions, and authorized signatory. Treat the attestation as part of the closeout record, not as a substitute for inventory reconciliation or evidence reasonably needed to verify completion.

How can a health information exchange maintain access to PHI during offboarding?

Plan continuity before the vendor’s access or service ends. Establish who can retrieve and use the PHI, how authorized users will access it, what export or interface is needed, and how the HIE will validate the transferred data. Where relevant, coordinate with participating covered entities and the incoming vendor so that the transition does not interrupt access needed for operations or applicable individual access requests.

Maintain role-appropriate permissions during the transition: keep access needed for an authorized transfer or validation, restrict it to the people and functions that require it, and remove permissions when those tasks end. The HIPAA Security Rule access controls standard requires technical policies and procedures that allow access to ePHI only to persons or software programs granted access rights. See 45 CFR § 164.312(a)(1).

A business associate generally may not block a covered entity’s access to PHI it maintains on the covered entity’s behalf, including to resolve a payment dispute. HHS explains that the business associate must maintain ePHI availability and return PHI as provided by the BAA upon termination, while recognizing that certain arrangements may specify that particular PHI will not be provided because of the nature of the services. See HHS guidance on covered entity access to PHI held by a business associate.

What steps document PHI disposal and access revocation?

Use a closeout record that makes it possible to trace each PHI location from discovery through return, destruction, or approved retention. A practical record can include:

• The vendor, service, HIE contact, applicable agreement, and effective offboarding dates.
• Systems, interfaces, devices, locations, PHI categories, and subcontractors checked, including backups and archives.
• Transfer dates, destination, format, validation results, and any unresolved data-integrity or completeness issues.
• For each retained copy, the reason, legal or contractual basis, location, authorized users, safeguards, use restrictions, and planned review or disposal event.
• For destruction, the data or media covered, method used, completion date, responsible party, and supporting records or attestation.
• Access revocation details, including accounts, credentials, tokens, keys, remote connections, and privileges removed, plus any narrowly limited temporary access and its expiration.
• Exceptions, incidents, approvals, corrective actions, and sign-off by the responsible HIE and vendor representatives.

These documentation elements are recommended policy controls; HIPAA’s specific requirements include safeguards for ePHI and procedures for final disposition and media reuse. The organization should also follow its record-retention schedule and applicable contract and legal requirements.

What protections apply to PHI that must be retained?

HIPAA generally does not require a business associate to retain ePHI after it finishes providing services. If return or destruction is infeasible, however, the BAA must extend its protections to the retained PHI and limit further use and disclosure to the purposes that make return or destruction infeasible. A legal retention obligation may be one example of infeasibility; it does not authorize unrelated use. See HHS guidance on retaining ePHI after services end.

Document each exception rather than treating all backups or archives as automatically exempt. Restrict access to retained copies, preserve appropriate administrative, physical, and technical safeguards, prevent routine operational use, and require destruction when the reason for retention ends and destruction becomes feasible. Apply the same contractual protections to relevant subcontractors.

How should the business associate agreement address termination and retained PHI?

Review the BAA before offboarding begins. Its termination provisions should state whether the vendor must return PHI, destroy it if the HIE agrees, or follow another agreed disposition; specify a practical transfer process and deadlines; and address PHI held by subcontractors and in backups or archives. HHS publishes sample BAA language with alternatives for return or destruction and for PHI that must be retained after termination. See HHS sample business associate agreement provisions.

Where return or destruction is infeasible, the agreement should identify or require documentation of the reason and retained PHI, continue applicable privacy and security protections, restrict further uses and disclosures to the purposes that make disposition infeasible, and require destruction when feasible. It should also preserve agreed access needed by the HIE and address transition cooperation, subcontractor obligations, incident reporting, and evidence of completion.

In short, an effective offboarding policy coordinates a usable PHI transfer, risk-appropriate destruction, continued safeguards for any PHI that must remain, and documented revocation of unneeded access—all consistent with the BAA and applicable law.

FAQs.

Does HIPAA require a vendor to retain PHI after services end?

No. HIPAA generally does not require a business associate to retain PHI after its services end. The BAA must provide for return or destruction when feasible. If disposition is infeasible, the BAA’s protections continue to apply to the retained PHI, and further uses and disclosures must be limited to the purposes that make return or destruction infeasible. See HHS guidance.

What should a vendor do if returning or destroying PHI is infeasible?

The vendor should document why return or destruction is infeasible, identify the PHI that must remain, and continue the BAA’s privacy and security protections for that information. It should restrict further use and disclosure to the purposes that make disposition infeasible and destroy the PHI when it becomes feasible, consistent with the BAA and applicable law.

Can a vendor block a health information exchange’s access to PHI during offboarding?

Generally, a business associate may not block a covered entity’s access to PHI it holds on the covered entity’s behalf, including as leverage in a payment dispute. HHS notes that the agreement and nature of particular services can affect whether certain PHI is to be returned or made available. Plan transition access and return obligations in the BAA. See HHS guidance on access to PHI held by a business associate.

How should a vendor document PHI destruction?

Maintain a record identifying the PHI or media covered, destruction or sanitization method, completion date, responsible party, and any copies that could not yet be destroyed. Provide a signed attestation if the BAA or HIE policy requires one, and retain supporting records appropriate to the method and risk. Also document related access revocation and any retained PHI’s justification and safeguards.