Remote Patient Monitoring Vendor BAA Checklist: Key Requirements to Review

When does an RPM vendor need a business associate agreement?

A remote patient monitoring (RPM) vendor generally needs a business associate agreement (BAA) when it performs services on behalf of a HIPAA-covered provider or another business associate and, as part of those services, creates, receives, maintains, or transmits protected health information (PHI). A vendor that handles patient readings, identifiers, alerts, or messages for a provider will often meet this test. The relationship and the vendor’s role—not simply the type of product it sells—determine whether a BAA is needed. See HHS guidance on business associates.

Before sharing PHI, identify who uses the RPM service, what data it handles, and whether the vendor is acting for the provider. Include relevant data flows, such as connected devices, mobile apps, monitoring dashboards, support teams, and cloud services, in your review. Some apps that an individual independently selects to receive their information may not be business associates; see HHS guidance on apps and business associate agreements.

Think of the BAA as one part of your vendor security risk assessment, not as proof that the vendor or your organization is automatically HIPAA-compliant. The agreement should match the actual services and data involved.

Define permitted uses and disclosures of protected health information

Describe the RPM services the vendor may perform and the PHI it may use for those services. For example, specify whether the vendor may collect readings, send alerts to clinical staff, contact patients about monitoring, or transmit information to your electronic health record system.

The BAA must limit the vendor’s use and disclosure of PHI to what the agreement permits or what the law requires. Be specific about any permitted disclosures to other parties and any separate uses, such as service administration or data aggregation. Avoid relying on a broad clause that could be read to authorize unrelated uses, such as advertising or product development. See HHS sample business associate agreement provisions.

Where the HIPAA minimum necessary standard applies, the vendor must limit relevant uses and disclosures to the minimum necessary for the purpose. The standard has exceptions, including certain disclosures for treatment, so make sure the agreement reflects the parties’ actual workflows and applicable rules. See HHS’s summary of the HIPAA Privacy Rule.

Review safeguards for electronic protected health information

RPM services can involve continuous flows of electronic protected health information (ePHI), including readings, account details, alerts, and messages. The BAA should require the vendor to comply with applicable HIPAA Security Rule requirements and to protect the confidentiality, integrity, and availability of ePHI. The Rule requires administrative, physical, and technical safeguards; see HHS’s summary of the HIPAA Security Rule.

As practical contract terms, identify expectations for access controls, authentication, audit logs, secure transmission, workforce access, and handling of lost or compromised devices. Align these details with the service’s risks rather than assuming one safeguard, such as encryption, answers every security concern.

The Security Rule requires regulated entities to conduct an accurate and thorough risk analysis of potential risks and vulnerabilities to ePHI. You can ask the vendor to explain its risk analysis and risk management process and to provide appropriate evidence of its safeguards. HIPAA does not expressly require every vendor to let its customer conduct an audit, so specify any documentation, review, or audit rights you need in the agreement. See HHS guidance on risk analysis and HHS guidance on customer reviews of cloud service providers.

Require written protections for subcontractors

Ask the vendor to identify subcontractors that will create, receive, maintain, or transmit your ePHI—for example, relevant hosting providers or monitoring and support services. The BAA must require the vendor to ensure that these subcontractors agree in writing to the same restrictions and conditions that apply to the vendor, as applicable. These subcontractor BAA obligations also apply down the chain when a subcontractor uses another subcontractor to handle ePHI. See HHS guidance on business associates and subcontractors.

For clearer oversight, consider requiring advance notice of material changes to the vendor’s subcontractors, a current subcontractor list, and a process for addressing concerns. These are useful contractual review terms; they are not a substitute for the written protections required by HIPAA.

Set security incident and breach reporting duties

The agreement should require the vendor to report security incidents and impermissible uses or disclosures of PHI, and to cooperate with your investigation. Define how the vendor will provide relevant details, such as affected information, known dates, individuals potentially affected, containment steps, and follow-up findings.

For a breach of unsecured PHI, a business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. That is an outer limit for the required breach notice, not a recommended response target for every incident. Your BAA can set a shorter deadline and specify a rapid initial notice followed by additional details as they become available. The covered entity generally handles required notices to individuals, HHS, or the media, with the vendor’s cooperation. See the HHS HIPAA Breach Notification Rule guidance.

Specify support for patient rights and records

The BAA should require the vendor to make PHI available to you as needed to respond to patient requests for access, and to support amendments to records when required. If the vendor maintains information in a designated record set, plan how your team can retrieve it promptly in a usable format. HHS explains that covered entities remain responsible for fulfilling individuals’ access, amendment, and accounting rights, including when relevant information is held by a business associate. See HHS guidance on business associates and individual rights.

Address how the vendor will provide information needed for an accounting of disclosures. HIPAA requires an accounting for certain disclosures, subject to exceptions; it does not require an accounting of every routine use or disclosure. Agree on the records, response process, and timing the vendor will provide so you can meet your own obligations.

Plan for termination and vendor compliance reviews

Specify how the vendor will return or destroy PHI when the agreement ends. HIPAA requires return or destruction where feasible; if that is not feasible, the BAA must extend its protections to the retained information and limit further uses and disclosures to the purposes that make return or destruction infeasible. Address copies, backups, and any legal retention duties, and document any agreed transition process. See HHS guidance on ePHI after services end.

Set a process for reviewing the vendor’s safeguards and compliance during the relationship, such as reviewing available security documentation and discussing material changes or incidents. HIPAA does not expressly require a business associate to provide security documentation or permit customer audits, so state any review rights you expect in the BAA or another contract. Also make sure the agreement allows termination for a material breach when required by the applicable BAA terms. See HHS guidance on vendor security reviews.

A strong RPM vendor BAA matches the services and data flows, sets clear safeguards and reporting duties, protects information handled by subcontractors, supports patient rights, and provides a workable exit plan. Use those points as a checklist alongside your organization’s own risk assessment and policies.

FAQs

When must a remote patient monitoring vendor sign a BAA?

A BAA is generally required when the vendor performs services on behalf of a covered entity or business associate that involve creating, receiving, maintaining, or transmitting PHI. Whether it is required depends on the vendor’s role and the data flow, not merely on its product being used for remote monitoring.

What security safeguards should an RPM vendor BAA require?

The BAA should require applicable HIPAA Security Rule safeguards and define practical expectations for access, audit logging, authentication, secure transmission, and incident response based on the risks to the ePHI involved. Consider asking for information about the vendor’s risk analysis and security practices; spell out any review or audit rights you need in the contract.

How should a BAA address subcontractors handling patient data?

Require the vendor to ensure that subcontractors handling ePHI sign written agreements with the same applicable restrictions and conditions. You may also include terms for subcontractor disclosures, notice of material changes, and oversight of downstream vendors.

What happens to protected health information when an RPM vendor agreement ends?

The vendor must return or destroy PHI where feasible. If return or destruction is infeasible, the BAA must continue to protect the retained PHI and restrict its further use and disclosure to the purposes that make return or destruction infeasible. The agreement should explain how the parties will handle data transfer, backups, and any required retention.