Medical Device Repair Depot Business Associate Agreement Checklist

A medical device repair depot may handle protected health information (PHI) stored on a device, even when its job is hardware diagnosis or repair. Use this checklist to define when a business associate agreement (BAA) is needed, limit access, set security expectations, and clarify incident response before a device leaves your facility.

When does a repair depot qualify as a business associate under HIPAA?

A depot generally qualifies as a HIPAA business associate when it performs services on behalf of a covered entity or another business associate and the work involves creating, receiving, maintaining, or transmitting PHI—or involves disclosing PHI to the depot. HHS specifically identifies a technician who services an electronic device that stores PHI, including a medical device, as a potential business associate when the contracted work involves disclosure of that PHI to the technician. See HHS guidance on business associates.

Assess the actual repair workflow, not just the service contract’s label. Consider whether technicians can access stored data during diagnostics, whether the depot receives devices with PHI still present, and whether remote support or data recovery is part of the service. If the work involves PHI, put a compliant BAA in place before permitting that access or disclosure.

A BAA may not be required when the depot’s work does not involve the use or disclosure of PHI and any access would be only incidental, if at all, with reasonable safeguards in place. HHS describes this limited exception for services such as those of an electrician or janitorial service; a repair depot should not assume it applies when its technicians have access to device data as part of the contracted work.

What PHI can depot personnel access during diagnosis and repair?

Define the information technicians may encounter, such as patient identifiers, device readings, diagnostic histories, images, logs, or other electronic protected health information (ePHI). Specify which device models, systems, and repair steps could expose that data, and whether access is necessary for the contracted service.

Set a role-based access process: identify which authorized technicians may access data, for what repair purpose, and under what approval or supervision. The agreement and operating procedures should limit access to what is reasonably needed to diagnose or repair the device. For service tasks that do not require viewing patient information, use options such as customer-provided test data, disabled data access, or a customer-controlled diagnostic process when feasible.

The Privacy Rule’s minimum necessary standard generally calls for reasonable efforts to limit PHI use, disclosure, and requests to what is needed for the purpose. Repair work is not itself a treatment disclosure. See HHS guidance on the minimum necessary requirement.

Which permitted uses and disclosures should the agreement define?

Describe permitted uses narrowly—for example, accessing device data only as needed to perform authorized diagnosis, maintenance, repair, testing, and return-to-service tasks. State that the depot may not use or disclose PHI for unrelated purposes, including marketing, independent analytics, product development, or staff training, unless separately permitted by law and properly authorized.

Require the depot to follow the BAA’s limits and applicable law, and to obtain the customer’s approval before making any disclosure not necessary for the service. If the depot may use an agent or subcontractor, specify which work may be delegated and require the appropriate written agreement before PHI is shared. HHS explains that a BAA must describe permitted and required uses and disclosures, and may not authorize uses that would violate the Privacy Rule if done by the covered entity. See HHS’s BAA requirements overview.

How should safeguards cover device storage, access, and data transfer?

Set safeguards that match the depot’s work and risks. The agreement can address secure intake and inventory, chain of custody, access-restricted storage, technician authorization, secure workstations, and controls for data copied during diagnostics. Specify how remote access, removable media, backups, and transfers to the customer will be protected, and how access and data handling will be logged.

For ePHI, the Security Rule requires appropriate administrative, physical, and technical safeguards to protect confidentiality, integrity, and availability. Its standards cover areas including facility access, workstation security, and device and media controls. The Security Rule is flexible and risk-based; it does not prescribe one set of technical measures for every depot. The BAA should state the safeguards the parties have agreed to use, informed by the depot’s environment and risk assessment. See HHS’s Security Rule summary and its guidance on physical safeguards.

Also document who may authorize data extraction or copying, where temporary diagnostic copies may be stored, how they are protected, and when they must be removed. These agreed controls help prevent a repair process from expanding into unnecessary PHI access or retention.

What breach reporting and investigation duties should the agreement set?

Require prompt reporting of security incidents and suspected or confirmed impermissible access, use, or disclosure. Define whom the depot must contact, how to reach them, what initial facts to provide, and how updates and supporting records will be delivered. Specify cooperation on containment, investigation, mitigation, and preservation of relevant evidence.

Do not treat every security incident as automatically a reportable breach. The BAA can set operational reporting expectations for incidents, while the Breach Notification Rule governs notification after a breach of unsecured PHI. A business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovering such a breach; the agreement may set a shorter reporting deadline. See HHS’s Breach Notification Rule guidance and HHS guidance on security-incident reporting.

Ask the depot to provide available details needed for the covered entity’s assessment, such as the device involved, the types of PHI, individuals affected if known, the time period, access or disclosure circumstances, and steps taken to contain and mitigate the event. The covered entity remains responsible for required notifications unless responsibilities are appropriately delegated.

How should subcontractors and return or destruction of PHI be handled?

List any subcontractors that may create, receive, maintain, or transmit PHI for the depot, including remote diagnostic or data-recovery providers. Require the depot to obtain a compliant subcontractor agreement before sharing PHI with them, and to ensure downstream subcontractors are bound to applicable privacy and Security Rule protections. HHS states that a business associate must have a BAA with a subcontractor before disclosing PHI for work performed on behalf of a covered entity. See HHS’s subcontractor and BAA guidance.

Specify whether the depot must return PHI with the repaired device, securely destroy it, or follow another documented instruction. Cover diagnostic copies, removable media, temporary files, backups, and records held by subcontractors. Require confirmation of completion when appropriate. If return or destruction is infeasible, the agreement should require continued protection and limit further uses and disclosures to the purposes that make return or destruction infeasible, consistent with the BAA terms.

HIPAA permits a covered entity to hire a business associate to dispose of PHI, but the arrangement must require appropriate safeguards through disposal. See HHS guidance on PHI disposal.

What exceptions and operational limits apply to repair access?

A depot’s status depends on the service relationship and whether the work involves PHI; it does not depend solely on whether a technician intentionally reads a patient record. Conversely, a vendor whose service does not involve PHI and whose access would be only incidental, if any, may not need a BAA if reasonable safeguards are in place. The limited conduit exception is generally intended for entities that only transmit PHI, including temporary storage, rather than those that access it regularly to perform a service.

If technicians unexpectedly encounter PHI outside the agreed workflow, the agreement should require them to stop unnecessary access, protect the device and data, promptly notify the customer, and follow customer instructions for controlled remediation. Document the event and reassess whether the service scope or access permissions need to change. Avoid treating incidental access as permission for broader inspection, copying, or retention.

In short, a strong repair-depot BAA ties access to a defined repair purpose, sets workable safeguards and reporting procedures, controls subcontractors, and specifies what happens to PHI after service is complete.

FAQs.

Does a medical device repair depot need a business associate agreement?

It generally needs a BAA when the contracted repair service involves PHI—for example, when device data is disclosed to technicians or they have access to stored PHI to perform the service. If the work does not involve PHI and any access would be only incidental, if at all, with reasonable safeguards, a BAA may not be required. Assess the actual workflow rather than relying on the service label.

Can depot technicians access PHI while diagnosing a device?

They may access PHI when that access is permitted by the BAA and necessary for the contracted diagnosis or repair, subject to applicable privacy and security requirements. Limit access to authorized personnel and the information reasonably needed for the task; avoid viewing, copying, or retaining data that is not needed.

What should a BAA require if a depot discovers exposed PHI?

It should require prompt notice to the covered entity or the depot’s business associate customer, steps to contain and mitigate the exposure, cooperation with the investigation, and delivery of available details about the data, device, affected individuals, and response. The BAA can require reporting sooner than the federal outer limit; a business associate must report a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery.

Must a repair depot’s subcontractors sign BAAs?

A depot acting as a business associate must have a compliant written agreement with a subcontractor before disclosing PHI to that subcontractor for work performed on behalf of the covered entity. The requirement applies when the subcontractor creates, receives, maintains, or transmits PHI on the depot’s behalf.