Patient Payment Portal Processor Business Associate Agreement Checklist

Determine whether the payment portal processor is a business associate

Before drafting an agreement, map what each vendor does and what information it handles. A vendor may be a business associate if it performs a function or service for your organization that involves creating, receiving, maintaining, or transmitting protected health information (PHI) on your behalf. Services such as billing or claims processing can qualify; the vendor’s role and access to PHI matter more than its label.

HHS distinguishes those arrangements from a financial institution’s ordinary payment-card or funds-transfer services, which it describes as not performed on behalf of the covered entity. So, payment-card processing alone does not automatically make a vendor a business associate. But a patient portal provider that also stores patient balances, links payments to patient accounts, or handles other PHI may have a different role. Assess each vendor and service separately using the HHS business associate guidance.

• Identify what patient or account data the portal sends to the processor, including whether it includes PHI.
• Confirm whether the processor only performs ordinary financial transaction services or also performs services for your organization involving PHI.
• If the vendor is a business associate, put a compliant written agreement in place before allowing it to handle PHI.

Define permitted uses and disclosures of protected health information

Describe the specific services the processor will perform and the PHI it may use or disclose to perform them. Limit access to the information needed for those services, and make clear that the processor may not use or disclose PHI beyond what the agreement permits or the law requires.

Specify any permitted uses for the processor’s proper management and administration, if applicable, and the conditions for any disclosures for those purposes. Do not rely on broad language that could be read to allow unrelated analytics, advertising, or other secondary uses. HHS sample business associate agreement provisions describe the required limits on uses and disclosures.

Specify privacy safeguards and electronic PHI security obligations

Require the processor to apply appropriate safeguards to PHI and comply with applicable HIPAA Security Rule requirements for electronic protected health information (ePHI). The contract should translate those obligations into clear expectations for the portal and payment workflow, including role-based access, authentication, activity logging, workforce security, incident response, and backup and recovery processes.

Address how the processor will protect data when it is transmitted, stored, accessed, and removed. You can set specific contractual security expectations, such as encryption or security-review documentation, based on the information and risks involved. The HHS Security Rule overview explains the safeguard obligations, while 45 CFR § 164.308 addresses administrative safeguards, including risk analysis, security incident procedures, and contingency planning.

Set breach and security incident reporting requirements

Require the processor to report security incidents it becomes aware of, not only incidents it has already determined are reportable breaches. Define how quickly it must alert you, how it will send updates, and what information it must provide, such as the incident’s nature, affected systems and individuals, PHI involved, containment steps, and investigation findings. HIPAA requires business associates to report security incidents; the agreement can establish practical reporting details and stricter timelines.

Separately address breaches of unsecured PHI. A business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. The agreement can require earlier notice so you have time to assess and meet your own notification duties. It should also require cooperation with investigation, mitigation, documentation, and any notices you assign to the processor. See the HHS security incident guidance and the HHS Breach Notification Rule guidance.

Flow down applicable obligations to subcontractors

Identify whether the processor will use cloud hosts, payment portal platforms, customer-support vendors, or other subcontractors that create, receive, maintain, or transmit PHI for it. Require the processor to obtain written assurances from each applicable subcontractor that it will follow the same relevant restrictions and safeguards that apply to the processor.

Require the processor to keep a current list of subcontractors that handle PHI, notify you of material changes, and remain responsible for managing their work under the agreement. A HIPAA subcontractor agreement must flow down applicable obligations; see the HHS business associate guidance and 45 CFR § 164.314.

Address support for patient rights and compliance reviews

Set out how the processor will help you respond to patient requests involving PHI it holds. The agreement should require it to make relevant information available for access requests, support amendments when directed, and provide records needed for an accounting of disclosures when applicable. The covered entity remains responsible for fulfilling HIPAA Privacy Rule duties to individuals, while the agreement specifies the processor’s assistance. HHS guidance on business associates and individual rights explains these responsibilities.

Also require the processor to make relevant records and practices available to HHS as required by the agreement and HIPAA rules. You may negotiate additional review rights, such as security documentation, audit summaries, or remediation updates; treat those as contractual oversight terms rather than assuming every specific audit method is universally required by HIPAA. The HHS sample agreement provisions outline the required availability of records for HHS review.

Establish termination and protected health information disposition terms

State what happens to PHI when the agreement or services end. Where feasible, the processor must return or destroy the PHI it still maintains and retain no copies. Specify the return format, transfer method, deadline, and how the processor will confirm destruction, including PHI held by applicable subcontractors.

If return or destruction is infeasible, the agreement must extend its protections to the retained PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible. Address the period of retention and what happens when the information is no longer needed. See HHS guidance on PHI disposition at termination and 45 CFR § 164.504.

A complete checklist confirms the vendor’s role, limits PHI use, sets security and incident-reporting expectations, flows obligations to subcontractors, supports patient rights, and provides a workable plan for PHI return or destruction. Confirm those terms match the portal’s actual data flows and services before signing.

FAQs

Does a patient payment portal processor need a business associate agreement?

It depends on what the processor does and what information it handles. If it performs services for your organization involving PHI—such as maintaining patient account details in the portal—a business associate agreement may be required. If it only performs ordinary payment-card or funds-transfer services, HHS distinguishes that activity from a business associate function. Assess the vendor’s complete role, not just the payment step.

Does payment-card processing alone make a vendor a business associate?

No. HHS describes a financial institution’s ordinary processing of consumer payment-card transactions and funds transfers as normal financial services, not work performed on behalf of a covered entity. A portal vendor may have additional services or PHI access that change the analysis, so evaluate those separately.

What breach and security incidents must a processor report?

The agreement should require prompt reporting of security incidents the processor becomes aware of, including suspected incidents, and define the information and timelines for those reports. For a breach of unsecured PHI, HIPAA requires a business associate to notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. The contract may set a shorter reporting deadline.

What should happen to PHI when the agreement ends?

Where feasible, the processor must return or destroy the PHI it still maintains and retain no copies. If return or destruction is infeasible, the agreement must continue protecting the retained PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible.