Patient-Reported Distress Screening Software Vendor BAA Tracker Checklist

A vendor tracker helps you connect each patient-reported distress screening tool to the protected health information (PHI) it handles, the services it provides, and the safeguards and contract terms you need to review. Use it as a procurement and oversight aid—not as a substitute for legal review, your organization’s risk analysis, or its own HIPAA compliance responsibilities.

When Is a BAA Required for Distress Screening Software?

A business associate agreement (BAA) is generally required when a HIPAA covered entity engages a vendor to perform a service or function on its behalf that involves creating, receiving, maintaining, or transmitting PHI. For example, a vendor may be a business associate if it hosts identifiable screening responses, processes them for a care team, or transmits them into a clinical system. HHS guidance on covered entities and business associates

Assess the actual service and data flow rather than relying on a product label or the vendor’s general statement that it is “HIPAA compliant.” Screening answers linked to a patient or otherwise identifiable in the care workflow may be PHI; whether HIPAA applies depends on the parties, their roles, and how the information is handled.

A vendor that only provides a service directly to an individual, rather than performing a function for or on behalf of a covered entity or business associate, may have a different HIPAA status. Evaluate the arrangement and data path before deciding that a BAA is or is not needed. HHS guidance on patient-directed apps

Cloud hosting does not by itself remove the need for a BAA when a cloud service provider creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate. HHS explains that this can apply even when the provider stores only encrypted ePHI and cannot decrypt it. HHS guidance on HIPAA and cloud computing

Map Vendors and Patient Data Flows

Start with a list of every vendor and service involved in screening, not just the platform named in the purchase agreement. Include tools for questionnaires, patient messaging, analytics, hosting, support, integrations, and data export when they may handle PHI.

For each vendor, document the path from collection through use, storage, sharing, and disposal. Record where screening responses, distress scores, free-text comments, identifiers, and follow-up notes enter or leave the workflow.

• Vendor and service: Legal entity, product name, service description, internal owner, and business purpose.
• Data collected: Patient identifiers, screening answers, scores, timestamps, contact details, and any other PHI fields.
• Data movement: Collection method, interfaces, recipient systems, export paths, and any manual transfers.
• Storage locations: Production systems, support tools, analytics environments, logs, and backups, as applicable.
• Other parties: Hosting providers and other subcontractors that may create, receive, maintain, or transmit PHI.
• Access and purpose: Which staff or roles can access the information, and why access is needed.

When a business associate uses a subcontractor to handle PHI, the business associate must obtain written assurances that the subcontractor agrees to the applicable restrictions and conditions. Track these subcontractor flow-down obligations, including whether the vendor has identified the relevant downstream services and documented the required agreements. HHS sample business associate contract provisions

What to Track in a Vendor BAA Review

Maintain one tracker entry per vendor-service relationship. Record the BAA’s status and enough detail to show what the agreement covers; a signed document alone does not tell you whether it matches the screening workflow in use.

• Agreement details: BAA status, parties’ legal names, effective date, renewal or review date, signatories, and linked service agreement.
• Scope: Covered services, PHI types, permitted and required uses and disclosures, and any stated limits on use.
• Incident terms: How the vendor reports impermissible uses or disclosures and security incidents, to whom, and within what contractually specified timeframe.
• Subcontractors: Whether subcontractors handle PHI, how flow-down obligations are addressed, and how changes to downstream services are communicated.
• Individual rights support: How the vendor will help make PHI available for access, amendment, or accounting obligations when applicable to its service.
• Termination terms: Return or destruction requirements, exceptions when return or destruction is infeasible, and what protections continue for retained PHI.
• Operational ownership: Internal business owner, privacy or security reviewer, open issues, evidence reviewed, and next review date.

HHS identifies required BAA provisions that include permitted uses and disclosures, appropriate safeguards, reporting, subcontractor obligations, support for certain individual rights, and return or destruction of PHI at termination when feasible. Use the tracker to flag whether the agreement addresses the requirements that apply to the specific relationship; have qualified reviewers resolve legal questions. HHS sample business associate contract provisions

Label tracker fields such as questionnaires, security reports, or audit evidence as your organization’s review practices unless a specific legal or contractual requirement applies. HIPAA does not make every procurement checklist item a universal BAA term.

Verify Access Controls and Security Safeguards

Review safeguards in the context of the vendor’s actual service and your own risk analysis. The HIPAA Security Rule requires covered entities and business associates to conduct a risk analysis and implement risk management measures; it also requires regular review of information-system activity. HHS Summary of the HIPAA Security Rule

For a screening platform, ask for clear explanations and appropriate evidence about controls relevant to the information and workflow, such as:

• Role-based access control: Whether access can be limited by job function, care relationship, or other relevant role, and how access is approved, changed, and removed.
• Authentication: How the system verifies user identity and manages account access.
• Audit controls: What user activity is recorded, how logs can be reviewed, and how suspicious access is investigated.
• Data protection: How PHI is protected during transmission and while stored, including in connected services where relevant.
• Incident response: How the vendor identifies, escalates, and reports incidents under the BAA and related contract terms.
• Operational safeguards: How the vendor manages workforce access, security responsibilities, and relevant risks to ePHI.

HIPAA specifies standards and required outcomes; it does not make a vendor’s marketing claim or a single security feature proof of compliance. Keep the review tied to the systems, data, and risks in your screening workflow, and document unresolved concerns and follow-up owners.

Document Data Retention Export and Disposal

Specify how your organization can retrieve screening records during the relationship and at exit. Confirm the export format, available fields, delivery method, timing, and any support needed to move the information into your record system or to another vendor.

Track retention separately for active records, logs, and backups where those categories apply. Ask how deletion is performed, how long backup copies may persist under the vendor’s processes, and how the vendor handles restoration scenarios. These are practical review questions to settle in the contract and implementation plan; do not assume that all data types share one deletion schedule.

At contract termination, the BAA generally must require the business associate, if feasible, to return or destroy PHI it still maintains and retain no copies. If that is infeasible, the agreement must extend its protections to the retained information and limit further uses and disclosures to the purposes that make return or destruction infeasible. 45 CFR § 164.504(e)(2)(J), official Code of Federal Regulations text

Record the agreed PHI disposition plan: what will be exported, what will be destroyed, who confirms completion, what evidence of completion is available, and what data must remain protected if it cannot feasibly be returned or destroyed. HHS states that HIPAA generally does not require a business associate to retain ePHI after it finishes providing services, while recognizing that return or destruction may be infeasible in some circumstances. HHS guidance on ePHI retention after services end

Compare Screening Workflows and Vendor Capabilities

Compare vendors against the care process your organization needs, as well as the contract and security review. A feature comparison is most useful when it makes clear what the platform does, what your staff must do, and where patient information travels.

• Patient experience: Supported languages, accessibility options, device compatibility, and ways patients can complete the screening.
• Clinical workflow: How responses and scores reach the care team, how follow-up tasks are assigned, and whether urgent responses can be routed according to your organization’s procedures.
• Integration and export: Available interfaces, data fields, export options, and the steps required to reconcile records.
• Configuration: Whether questionnaires, thresholds, notifications, and user permissions can be configured and governed by your organization.
• Vendor support: Support access to production data, escalation paths, service expectations, and relevant contract provisions.
• Data lifecycle: Retention options, backup handling, portability, and PHI disposition at termination.
• Evidence and open questions: Documentation reviewed, limitations, unresolved risks, and the person responsible for follow-up.

Do not treat a signed BAA as proof that the entire screening workflow is HIPAA compliant. The BAA sets contractual obligations for the business associate, but your organization must also evaluate its own roles, systems, policies, safeguards, and risks. HHS describes risk analysis and risk management as Security Rule requirements for covered entities and business associates. HHS Summary of the HIPAA Security Rule

In short, keep a current map of vendors and data flows, verify that each BAA fits the service, review safeguards and subcontractor obligations, and document how screening PHI can be accessed, exported, retained, and disposed of.

FAQs.

Does a patient distress screening software vendor need a BAA?

Usually, if the vendor performs a service on behalf of a HIPAA covered entity or business associate that involves creating, receiving, maintaining, or transmitting PHI. The answer depends on the vendor’s role and the data flow; a product used directly by an individual may be a different arrangement. HHS guidance on covered entities and business associates

What should a BAA tracker record for each vendor?

Record the vendor and service, PHI involved, purpose and data flow, BAA parties and status, permitted uses, incident-reporting terms, subcontractor flow-down obligations, applicable safeguards, termination and PHI disposition terms, internal owner, and review date. Track open issues and evidence separately so reviewers can see what is verified and what still needs follow-up.

Does signing a BAA make a screening workflow HIPAA compliant?

No. A BAA is an important contractual safeguard when required, but it does not by itself establish that your organization’s complete workflow complies with HIPAA. Review your own risk analysis, access practices, policies, system configuration, and handling of screening information. HHS Summary of the HIPAA Security Rule

How should vendors handle screening responses and backups at contract termination?

Set out an export and PHI disposition plan in the agreement and operational checklist. When feasible, the business associate must return or destroy PHI it still maintains and retain no copies. If return or destruction is infeasible, the BAA must continue protecting the retained PHI and limit further use and disclosure to the purposes that make disposition infeasible. Address backup handling in the plan and document what remains, why, and how it stays protected. 45 CFR § 164.504(e)(2)(J), official Code of Federal Regulations text