Hospital TV and Patient Entertainment Vendor BAA Checklist

Determine whether the vendor is a business associate

Start with what the vendor actually does—not its product label or its claims about security. A hospital TV vendor is generally a business associate if it performs a service for the hospital that involves creating, receiving, maintaining, or transmitting protected health information (PHI) on the hospital’s behalf.

Check whether the service connects to hospital systems or uses patient-specific information—for example, to authenticate a patient, show clinical or account information, or support a hospital service. If the vendor’s work does not involve PHI and any access to it would be merely incidental, a BAA may not be required. HHS explains the business-associate test and the limited incidental-access distinction in its Business Associates guidance.

• Map the vendor’s services, system connections, and data flows.
• Identify whether the vendor acts on the hospital’s behalf or uses information independently.
• Document the hospital’s determination and revisit it if the service or data flows change.

Identify PHI handled by bedside entertainment features

Inventory each feature and the information it collects, displays, stores, or sends. Possible data points include patient names or identifiers, room and admission details, portal authentication data, messages, support requests, and activity or usage logs. A data point is PHI when it identifies—or could reasonably identify—a person and relates to their health care, condition, or payment for care.

Trace information through the full service, including the bedside device, vendor platform, remote support tools, analytics, backups, and integrations. Record which party can access each data type, why access is needed, and how long the information is retained. HHS describes PHI and the business-associate relationship in its Summary of the HIPAA Privacy Rule.

Check required BAA terms for uses and safeguards

Confirm that the BAA describes the vendor’s permitted and required uses and disclosures of PHI, prohibits other uses or disclosures except as required by law, and requires appropriate safeguards. The agreement should fit the hospital TV service specifically: identify the data involved, the service purpose, approved access, and any permitted disclosures.

Where the vendor handles electronic protected health information (ePHI), the BAA must address applicable HIPAA Security Rule requirements. It should also require cooperation with the hospital’s duties concerning patient access, amendments, and accounting of disclosures when relevant. HHS summarizes required BAA provisions and provides sample language in its Business Associate Contracts guidance.

Separate federal requirements from additional contract protections the hospital may choose to negotiate. For example, a specific encryption method, audit frequency, or incident-notice deadline may be a useful contractual term, but do not present it as a universal HIPAA requirement unless the applicable rule says so.

Confirm Security Rule duties and incident reporting

For ePHI, verify that the vendor has assigned security responsibilities and maintains safeguards appropriate to its role, including administrative, physical, and technical protections. The HHS summary of the HIPAA Security Rule explains that business associate agreements must address applicable Security Rule requirements and reporting of security incidents.

Make sure the BAA requires the vendor to report security incidents it becomes aware of. Set a practical reporting process: who receives notices, how to report suspected incidents, what initial facts to provide, and how updates and investigation records will be shared. A security incident is not automatically a reportable breach, so define the process for triage and escalation without treating the terms as interchangeable.

Verify subcontractor BAAs before PHI disclosure

Ask the vendor to identify subcontractors that create, receive, maintain, or transmit PHI for the service. This may include hosting providers, remote-support companies, analytics providers, and platform operators; verify their actual access rather than relying on a generic vendor list.

A business associate must obtain written assurances from a business associate subcontractor that handles PHI, including required protections and applicable Security Rule safeguards for ePHI. The hospital’s BAA should require the vendor to flow down the relevant restrictions and protections before disclosing PHI to a subcontractor. See HHS guidance on business associates and subcontractors.

Review breach response and termination procedures

Check that the agreement requires prompt notice of impermissible uses or disclosures, security incidents, and breaches of unsecured PHI, and specifies the contact method and operational steps. HIPAA requires a business associate to notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery; the parties can agree to a shorter reporting period. The hospital generally remains responsible for required notices to individuals and HHS, although it may delegate notice tasks by agreement. See the HHS Breach Notification Rule guidance.

Confirm that the BAA authorizes termination for a material violation and explains what happens to PHI when the agreement ends. The agreement must provide for return or destruction of PHI if feasible. If that is infeasible, it must extend the BAA protections and limit further uses and disclosures to the purposes that make return or destruction infeasible. HHS discusses these termination requirements in its guidance on retaining ePHI after services end.

Assess patient portal access and retained electronic PHI

Determine whether the bedside system merely links a patient to a hospital portal or whether the vendor receives, displays, or stores portal information. Review authentication, session handling, access controls, screen privacy, support access, and whether patient information remains on the device or in vendor systems after use.

If the vendor maintains PHI in a designated record set on the hospital’s behalf, the patient’s HIPAA access right extends to that information. The BAA should support the hospital’s ability to retrieve relevant records and respond to patient requests; it should also specify retention, return, deletion, and any limited retention that is necessary or legally required. HHS explains access to information held by a business associate in its Right to Access guidance.

In short, base the BAA decision on the vendor’s actual role and data flows, then confirm that the contract covers permitted use, safeguards, subcontractors, incident and breach response, patient access support, and end-of-service handling of PHI.

FAQs

When does a hospital TV vendor need a BAA?

A hospital TV vendor generally needs a BAA when it performs a service on the hospital’s behalf that involves creating, receiving, maintaining, or transmitting PHI. A vendor whose service does not involve PHI, and whose access to PHI would be incidental, if any, may not need one. Assess the actual features and data flows rather than the vendor’s label.

Does incidental access to PHI require a BAA?

Not necessarily. HHS says a business associate contract is not required when the service does not involve using or disclosing PHI and any access would be merely incidental, if at all. Incidental access is not a blanket exception for a vendor whose service actually depends on handling PHI. See HHS Business Associates guidance.

What BAA terms apply to patient entertainment systems?

The BAA must describe permitted and required uses and disclosures, restrict other uses and disclosures, require appropriate safeguards, address applicable Security Rule duties for ePHI, and cover incident reporting, subcontractors, patient-rights support where relevant, and return or destruction of PHI at termination when feasible. Tailor additional operational details—such as system access, data retention, and reporting contacts—to the service.

Must a vendor sign a BAA with subcontractors that handle PHI?

Yes. A business associate must obtain written assurances from a subcontractor that creates, receives, maintains, or transmits PHI on its behalf. The subcontractor agreement must impose the applicable restrictions and protections, including Security Rule safeguards for ePHI. The hospital should require its vendor to confirm that these agreements are in place before PHI is disclosed.