Patient Satisfaction Survey Vendors: Business Associate Agreement Requirements

When does a patient satisfaction survey vendor qualify as a business associate?

A patient satisfaction survey vendor generally qualifies as a business associate when it performs a service for a HIPAA-covered provider or health plan that involves creating, receiving, maintaining, or transmitting protected health information (PHI). For example, a vendor that uses a patient list to send invitations, links responses to identifiable patients, or stores survey answers alongside patient identifiers may be handling PHI on the organization’s behalf. The HIPAA business associate obligations apply based on the vendor’s role and data handling—not simply the name of the service. See HHS guidance on business associates.

A vendor that receives only properly de-identified information, or that does not handle PHI on the covered entity’s behalf, may not need a business associate agreement (BAA) for that service. Assess the actual data flow, including invitation lists, survey links, response records, and support access, before deciding.

What assurances should the business associate agreement include?

The BAA should define the survey services and permitted uses and disclosures of PHI, prohibit other uses or disclosures except as allowed by the agreement or law, and require appropriate safeguards. It should also address reporting unauthorized PHI disclosure and breaches, cooperation with individual privacy rights where applicable, and return or destruction of PHI at termination when feasible. The agreement must require the vendor to bind relevant subcontractors to the same restrictions and conditions. See 45 CFR § 164.504(e) and HHS sample business associate agreement provisions.

For a survey service, specify which data the vendor may use, who can access it, how long it may be retained, and how it will be securely returned or destroyed. A BAA documents required assurances; it does not by itself establish that the vendor’s systems or practices meet every applicable requirement.

How should vendors protect survey data during transmission and storage?

Set out appropriate protected health information safeguards for the data’s full lifecycle: transfer, collection, storage, access, backup, and deletion. Practical controls may include secure file transmission protocols such as an authenticated secure portal or SFTP, encryption where appropriate, role-based access, unique user accounts, audit logs, and documented retention and disposal procedures. Match the safeguards to the organization’s risk analysis and the vendor’s actual service.

HIPAA’s Security Rule requires technical measures to guard against unauthorized access to electronic PHI in transit. Encryption is an addressable implementation specification, meaning the regulated organization must assess whether it is reasonable and appropriate and implement it or document an equivalent alternative. Email is not categorically prohibited, but e-PHI sent over an electronic network must be adequately protected. See 45 CFR § 164.312(e) and HHS guidance on sending e-PHI by email.

What confidentiality rules apply to vendor personnel and subcontractors?

The vendor should limit PHI access to personnel who need it for the contracted survey work, explain their confidentiality responsibilities, and address appropriate safeguards in its policies and contracts. HIPAA requires a BAA to ensure that the business associate’s agents, including subcontractors who handle PHI, agree to the same restrictions and conditions that apply to the business associate. A business associate subcontractor agreement is therefore important when a downstream provider will create, receive, maintain, or transmit PHI on the vendor’s behalf. See 45 CFR § 164.504(e) and 45 CFR § 164.308(b).

Ask the vendor to identify relevant subcontractors and explain how it manages their access and confidentiality commitments. HIPAA requires the contractual assurances described in the rules; it does not prescribe one universal employee confidentiality-agreement template.

When does survey software access require a business associate agreement?

Survey software generally requires a BAA when it is used on behalf of a covered entity to create, receive, maintain, or transmit PHI. This can include storing identifiable survey responses or invitation data, even if vendor employees do not routinely view the content. A cloud provider that maintains encrypted e-PHI may still be a business associate even when it lacks the decryption key. See HHS guidance on encrypted e-PHI stored by cloud providers.

A narrow conduit exception may apply to a service that only transmits PHI and has no more than transient access incidental to transmission. It generally does not cover a survey platform that persistently stores or processes survey data. Determine whether the software provider handles PHI on the organization’s behalf, rather than relying only on a claim that the provider cannot access or read it.

What should survey invitation emails include?

Keep an invitation neutral and brief: identify the healthcare organization, explain that participation is voluntary, provide a secure survey link and a way to contact the organization with questions, and avoid unnecessary clinical details in the subject line or message. A patient’s name or email address linked to a survey or care relationship may reveal information about that person, so limit what the message discloses and check recipient addresses before sending. HHS advises covered entities to use reasonable safeguards for email communications, including precautions to reduce unintended disclosure. See HHS guidance on email communications with patients.

Include a clear electronic communication opt-out or preference-management instruction when appropriate for the organization’s policies and the communication program. HIPAA does not establish a universal opt-out requirement for every patient satisfaction survey invitation, so do not present an opt-out as a general HIPAA mandate.

When is a new business associate agreement needed after changing vendors?

Before a replacement survey vendor receives PHI on the covered entity’s behalf, put a BAA in place with that vendor if its work meets the business associate definition. A BAA with the previous vendor does not cover a separate replacement vendor. For the outgoing vendor, follow the agreement’s termination provisions for returning or destroying PHI when feasible, and address any PHI that cannot feasibly be returned or destroyed as the agreement requires.

If the same vendor remains but its services, data access, or subcontractors change, review whether the existing BAA still accurately covers the arrangement and update it as needed. In short, assess each vendor relationship and data flow, document the required assurances, and protect PHI through the transition.

FAQs

Does every patient satisfaction survey vendor need a business associate agreement?

No. A BAA is generally needed when the vendor performs a service on behalf of a covered entity that involves PHI. A vendor receiving only properly de-identified information, with no role involving PHI, may not need one for that service. Assess what information the vendor and its subcontractors actually create, receive, maintain, or transmit.

Can a software provider avoid business associate status if it cannot access protected health information?

Not merely because it cannot view the information. A provider that maintains encrypted e-PHI on behalf of a covered entity may still be a business associate even without the decryption key. A limited conduit exception may apply to transmission-only services with transient access, but ordinarily not to software that stores survey data. See HHS guidance on cloud providers and encrypted e-PHI.

Can protected health information be sent to a survey vendor by unsecured email?

HIPAA does not categorically prohibit email, but e-PHI sent over a network must be adequately protected under the Security Rule. Use a secure portal or another suitable protected transfer method when appropriate; if email is considered, assess the risks and safeguards rather than assuming ordinary unsecured email is acceptable. See HHS guidance on email and e-PHI.

What should a survey invitation email say about opting out?

Where the organization offers an opt-out, state it plainly and provide a simple way to change communication preferences, such as a reply instruction or preference link. Keep the invitation concise, avoid unnecessary health details, and follow the organization’s policies. HIPAA does not create a universal opt-out requirement for every patient satisfaction survey invitation.