Patient Collections Agency Business Associate Agreement Checklist

Use this checklist to review how a patient collections agency may handle protected health information (PHI) for a health care provider or health plan. A business associate agreement (BAA) should define the agency’s role, limit PHI use, establish safeguards and reporting duties, and explain what happens to the information when the relationship ends.

When does a patient collections agency qualify as a business associate?

A collections agency generally qualifies as a business associate when a covered entity engages it to collect patient debt on the entity’s behalf and the agency uses or receives PHI to perform that work. HHS recognizes debt collection as a payment activity and says a covered entity may use a collection agency through a business associate arrangement. See HHS guidance on debt collection agencies.

The service label alone does not decide the issue. The agency’s actual functions and relationship with the covered entity matter; an agency that does not use or disclose PHI in performing its services may not be a business associate on that basis. If the agency is acting as a business associate, the parties need a written contract or other written arrangement with the required terms under 45 CFR § 164.504(e).

• Identify the covered entity, the agency, and the services the agency will perform.
• Specify the PHI the agency may receive or create for the collection work.
• Confirm the BAA is in place before the agency handles PHI on the covered entity’s behalf.

How should the agreement define permitted uses and disclosures of PHI?

Describe permitted uses and disclosures in terms of the agency’s specific collection tasks, such as account administration, billing, payment follow-up, and related data processing. The contract should prohibit uses or disclosures outside those terms unless required by law, and should not authorize the agency to use PHI in ways that would violate the Privacy Rule if the covered entity did so. The HHS sample business associate contract provisions outline these requirements.

Build the HIPAA minimum necessary standard into the agreement and the parties’ procedures. Specify the information the agency needs for its work, who may access it, and when disclosures are allowed. For example, collection work may require identifying and account information, but the agreement should not permit unrestricted access to clinical details without a defined need. HHS describes the standard and its exceptions in its minimum necessary guidance.

Set boundaries for any permitted disclosures to third parties and require the agency to follow applicable law and the BAA. The agreement should not be treated as permission to disclose all information in a patient’s record merely because the purpose is debt collection.

What safeguards and Security Rule requirements should the BAA include?

Require appropriate safeguards to prevent PHI from being used or disclosed outside the agreement. If the agency creates, receives, maintains, or transmits electronic protected health information (ePHI), the agreement must require compliance with applicable HIPAA Security Rule requirements. The Security Rule calls for administrative, physical, and technical safeguards to protect ePHI’s confidentiality, integrity, and availability. See the HHS Security Rule overview and 45 CFR § 164.314.

Make the agreement specific enough to support workable security procedures. Depending on the agency’s systems and operations, address:

• Risk analysis, workforce access controls, and procedures for granting or removing access.
• Physical protections for workstations, facilities, and devices or media containing ePHI.
• Technical safeguards such as unique user identification, access controls, audit controls, and transmission security.
• Security incident response, mitigation, and documentation.
• Contingency and backup procedures, where appropriate to the systems holding ePHI.

These examples are a practical checklist, not a substitute for a risk-based assessment of the agency’s environment. The Security Rule requires reasonable and appropriate safeguards; it does not prescribe one universal security setup for every organization.

How should the agency report security incidents and breaches?

Require the agency to report any use or disclosure of PHI not permitted by the BAA and any security incident it becomes aware of. A security incident can include an attempted or successful unauthorized access, use, disclosure, modification, or destruction of information, or interference with system operations. HHS explains that the BAA can set the level of detail, format, and frequency for general security incident reports in its security incident reporting guidance.

For a breach of unsecured PHI, federal law requires the business associate to notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. That is an outside limit, not a recommended waiting period; set a shorter contractual deadline if the covered entity needs more time to investigate and meet its own duties. The agency should provide, as available, the identities of affected individuals and other information needed for notifications. See 45 CFR § 164.410.

The BAA should state who investigates, preserves relevant records, coordinates communications, and prepares any notices the parties agree the agency will handle. The covered entity generally remains responsible for ensuring required notices are made, although it may delegate notice tasks to the agency. HHS summarizes these obligations in its Breach Notification Rule guidance.

What written assurances are required for subcontractors?

If the agency uses a subcontractor that will create, receive, maintain, or transmit PHI on its behalf, the agency must obtain written assurances that the subcontractor will follow the same applicable restrictions and conditions. The agreement should require the agency to put a compliant written agreement in place before disclosing PHI to that subcontractor.

Consider listing the subcontractor categories or services that may involve PHI, requiring advance notice of material changes, and setting a process for confirming that agreements are in place. The covered entity generally does not need a separate BAA directly with each downstream subcontractor; the agency is responsible for obtaining the required assurances. See HHS Business Associate FAQs.

How should the BAA address access, amendment, and compliance records?

Require the agency to make PHI in a designated record set available as needed for the covered entity to respond to individual access requests. The parties can specify whether the agency sends the information to the covered entity or, if agreed, responds directly to individuals. Either way, the process should support the applicable response deadlines; HHS explains that access rights extend to relevant PHI held by a business associate in its access guidance.

The BAA should also require the agency to make records available for amendments and to incorporate amendments when directed by the covered entity, as required by the contract. If the agency maintains information needed for an accounting of disclosures, require it to provide that information so the covered entity can meet its obligations. The HHS guidance on business associates and individual rights explains these responsibilities.

Include a clause requiring the agency to make its internal practices, books, and records relating to PHI available to the HHS Secretary for determining the covered entity’s compliance with the Privacy Rule. Identify a contact and a prompt process for handling such requests. This obligation is distinct from any separate audit rights the parties choose to negotiate.

What happens to PHI when the agreement ends?

At termination, the BAA must require the agency, if feasible, to return or destroy PHI it received from or created or received on behalf of the covered entity, including information it still maintains in any form. The agreement should specify the return format, transfer process, deadline, and how the agency will confirm destruction.

If return or destruction is infeasible, the BAA must extend its privacy and security protections to the retained PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible. Identify what information must be retained, why, who may access it, and when it will be returned or destroyed. HHS explains this rule in its guidance on PHI after services end.

A sound BAA therefore defines the agency’s collection role, limits PHI to that purpose, sets enforceable safeguards and reporting procedures, flows protections down to subcontractors, supports individual rights and HHS oversight, and provides a clear PHI return or destruction at termination process.

FAQs

Does a patient collections agency need a HIPAA business associate agreement?

Generally, yes, when a covered entity engages the agency to collect patient debt on its behalf and the agency uses or receives PHI to perform that service. HHS recognizes debt collection as a payment activity and describes using a collection agency through a business associate arrangement. Whether a particular agency qualifies depends on its actual role and handling of PHI.

What PHI may a collections agency use to collect patient debt?

The agency may use or disclose PHI only as permitted by the BAA or required by law. The agreement should define the information and uses needed for the collection work and apply the HIPAA minimum necessary standard where applicable. A collection purpose does not authorize access to an entire medical record without a need.

How quickly must an agency report a breach to the covered entity?

For a breach of unsecured PHI, the agency must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. The BAA may require earlier notice, and a shorter reporting period can help the covered entity respond to the incident and meet its own notification duties.

What should happen to PHI when the BAA terminates?

The agency should return or destroy the PHI it maintains for the covered entity if feasible. If return or destruction is infeasible, the agreement’s protections must continue to apply, and the agency must limit further use or disclosure to the purposes that make return or destruction infeasible.