Home Health EVV Vendor BAA Checklist: Key HIPAA Requirements

Electronic visit verification (EVV) systems can handle sensitive information about patients, care, and home visits. Before sharing that information, identify the vendor’s role, define what it may do with protected health information (PHI), and verify how the agreement addresses safeguards, incidents, subcontractors, and the end of the relationship.

When does a home health EVV vendor need a BAA?

A home health EVV vendor generally needs a business associate agreement (BAA) when it performs a service for a HIPAA-covered agency that involves creating, receiving, maintaining, or transmitting PHI on the agency’s behalf. That may include hosting EVV records, processing visit data, providing technical support that can access patient information, or connecting the system to the agency’s clinical or billing tools. HHS guidance on business associates explains the role-based test.

Do not assume that every company selling EVV software automatically needs a BAA—or that a vendor avoids one just because its staff do not routinely view records. Consider what information the vendor’s systems create, receive, maintain, or transmit, and what its services allow it to access. HHS distinguishes business associates from limited conduit services that only transmit information temporarily. Have the agency’s privacy or legal adviser assess the specific arrangement.

When the vendor is a business associate, put the BAA in place before disclosing PHI. The agreement should describe the work, the PHI involved, and the vendor’s privacy and security obligations. A vendor’s general statement that its product is “HIPAA compliant” does not replace an agreement that fits the agency’s services and data flows.

What permitted uses and disclosures of PHI should the BAA specify?

Describe the vendor’s permitted uses and disclosures in terms of the actual EVV services it provides. For example, the agreement may allow the vendor to process visit records, support authorized users, maintain the system, and provide agency-requested reports. It should also state that the vendor will not use or disclose PHI beyond the BAA’s terms or what the law requires. HHS sample BAA provisions outline required contract terms.

Set clear limits on uses that are not needed to deliver the service. Address secondary analytics, product development, advertising, and sharing with outside parties explicitly. If the vendor may use information for management, administration, or data aggregation, the BAA should define the permitted purpose and applicable conditions rather than leave broad, open-ended permission.

Specify how the vendor will help the agency meet relevant Privacy Rule duties, such as responding to requests for access, amendments, or accounting of disclosures when the vendor holds information needed for those tasks. Define how the vendor will provide records and how quickly. Apply the minimum necessary standard where it applies, while recognizing that HIPAA has exceptions, including certain treatment disclosures. HHS guidance on the minimum necessary standard explains its scope.

How should the BAA address security incidents and breaches?

Require the vendor to report impermissible uses or disclosures, security incidents, and breaches of unsecured PHI. HIPAA defines a security incident broadly to include attempted or successful unauthorized access, use, disclosure, modification, or destruction of information, as well as interference with system operations. HHS explains the Security Rule’s incident definition.

Set a practical notice deadline in the BAA, including for suspected incidents, so the agency has time to investigate and meet its own obligations. HIPAA requires a business associate to notify the covered entity after discovering a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery. That is the outer federal deadline for breach notice—not a recommended response time for every vendor incident. HHS breach-notification guidance describes the rule.

Specify the details the vendor must provide, such as what happened, when it occurred and was discovered, the types of information involved, the individuals affected if known, containment steps, and investigation updates. Clarify who will coordinate notifications to individuals, HHS, or others when required. The agency remains responsible for assessing its own duties; the BAA should establish how the vendor will promptly support that work.

Which EVV data elements require protection?

Whether a particular data item is PHI depends on its content and whether it identifies, or could reasonably identify, a person in connection with health information or care. An EVV record may contain several linked elements that together reveal a patient’s identity and services. Review the vendor’s full data flow, not just the fields displayed on a visit screen.

• Patient identifiers: name, address, phone number, date of birth, account number, or another identifier linked to care.
• Visit and service details: dates and times, visit status, service type, tasks completed, and records connecting a patient to home health care.
• Location information: address or location data associated with a patient or a visit to their home.
• Care-related information: diagnoses, care-plan details, notes, or other clinical information included in an EVV record or integration.
• Supporting records: signatures, messages, attachments, photographs, or audit logs that identify a patient or reveal information about their care.

Caregiver names, schedules, device identifiers, and location data may also be sensitive. They are not automatically patient PHI simply because they appear in an EVV system; assess whether they are linked to identifiable information about an individual’s health or care. Document which data the vendor handles, where it is stored, who can access it, and whether it is shared with other systems or service providers.

What security safeguards should agencies verify?

The HIPAA Security Rule requires appropriate safeguards for electronic PHI (ePHI), including administrative, physical, and technical safeguards. Ask how the vendor protects confidentiality, integrity, and availability, and request evidence that matches the risks and services involved. HIPAA does not prescribe one identical technology setup for every organization. HHS’s Security Rule summary describes the applicable safeguards.

• Access controls: individual accounts, role-based permissions, timely removal of access, and controls for mobile devices and support personnel.
• Authentication and auditability: safeguards for verifying users and records of access and system activity that can help investigate unusual activity.
• Data protection: protections for ePHI in storage and transmission, with a documented assessment of appropriate technical measures, including encryption.
• Security management: risk analysis, risk management, workforce training, and procedures for detecting, responding to, documenting, and mitigating incidents.
• Continuity and recovery: retrievable backups, a disaster recovery plan, and procedures for continuing essential operations during an emergency.

Ask the vendor to explain how safeguards apply to its application, hosting environment, integrations, support access, and mobile use. A disaster recovery plan should address restoring data and continuing critical operations; ask how the vendor tests its recovery procedures and what service or data-recovery commitments the contract includes. HHS identifies backup, disaster recovery, and emergency operations planning as parts of the Security Rule’s contingency-plan requirements. HHS contingency-planning guidance provides further detail.

How should agencies oversee vendor subcontractors and BAA records?

Find out which subcontractors may create, receive, maintain, or transmit the agency’s PHI—for example, hosting, messaging, analytics, or support providers. HIPAA requires a business associate to obtain assurances from relevant subcontractors through written agreements imposing the applicable privacy and security restrictions. HHS business associate guidance describes these downstream obligations.

Use the BAA or related contract to set practical expectations for subcontractor transparency, advance notice of material changes, and evidence that required agreements are in place. Ask how the vendor manages subcontractor access and incidents, and how it will assist if a subcontractor’s actions affect the agency’s PHI. HIPAA requires appropriate downstream agreements; specific approval, notice, and reporting procedures can be addressed in the contract.

Keep the signed BAA, amendments, relevant vendor and subcontractor information, security-review records, and incident communications in an organized record system. The BAA should also address termination: HHS’s sample provisions call for PHI to be returned or destroyed when feasible, with protections for any PHI that must be retained. If a material violation occurs, the agency must take reasonable steps to address it and, if unsuccessful, terminate the arrangement when feasible. HHS sample BAA provisions cover these contract terms.

In short: determine whether the EVV vendor is acting as a business associate, define its permitted PHI uses, and make incident reporting, safeguards, subcontractor agreements, and data return or destruction part of a clear written BAA. Review the vendor’s actual systems and data flows so the agreement addresses how the agency uses EVV in practice.

FAQs

Does every home health EVV vendor need a BAA?

No. Whether a BAA is required depends on the vendor’s role and whether it handles PHI on behalf of a HIPAA-covered agency. A vendor that creates, receives, maintains, or transmits PHI while providing services will generally be a business associate; assess the specific arrangement before sharing data.

What uses of PHI should an EVV vendor BAA permit?

The BAA should permit only the uses and disclosures needed for the EVV services and any other specifically authorized purposes. It should prohibit uses or disclosures outside the agreement or those required by law, and explain how the vendor will help with applicable agency Privacy Rule duties.

What security incidents must an EVV vendor report?

The BAA should require reporting of security incidents, impermissible uses or disclosures, and breaches of unsecured PHI. HIPAA’s definition of security incident includes attempted as well as successful unauthorized access or interference with system operations. Set a prompt contractual reporting deadline; the federal 60-day maximum for breach notice is not a suggested operational target.

Does the BAA need to cover EVV vendor subcontractors?

Yes, when a subcontractor creates, receives, maintains, or transmits the agency’s PHI for the vendor. The vendor must ensure the subcontractor agrees in writing to the applicable restrictions and requirements. The agency can also use its contract to establish practical subcontractor transparency and notification expectations.