Risk Adjustment Chart Retrieval Vendor BAA Checklist: Key Requirements

A risk adjustment chart retrieval vendor may handle sensitive medical records while locating, collecting, processing, or submitting documentation. A clear HIPAA business associate agreement (BAA) helps define what the vendor may do with protected health information (PHI), how it must protect that information, and how records should move through the retrieval workflow.

Use this checklist to review the agreement alongside the service contract and your organization’s policies. The BAA should reflect the vendor’s actual role and data flows; it does not by itself establish that every disclosure or use of PHI is permitted.

When does a chart retrieval vendor qualify as a business associate?

A vendor generally qualifies as a business associate when it performs a service or function on behalf of a covered entity that involves creating, receiving, maintaining, or transmitting PHI. For example, a vendor hired to request medical records from providers, retrieve them, and deliver them to a health plan may handle PHI while carrying out work for that plan. The relationship and actual services matter; assess who the vendor serves and what information it handles rather than relying on the vendor’s label. HHS guidance on covered entities and business associates.

Map the full chain of access before signing: the health plan or other covered entity, any business associate that hires the vendor, the chart retrieval vendor, and any subcontractors that may handle PHI. A vendor’s agreement may need to be with the entity that engages it in the business associate chain, rather than directly with every organization whose records it retrieves. HIPAA requires written arrangements that meet applicable BAA requirements for business associates and their subcontractors. HHS business associate guidance.

Confirm that the agreement identifies the parties, covered services, PHI involved, and permitted access. A vendor’s general privacy policy or assurance that it is “HIPAA compliant” does not replace the required written arrangement when the vendor is a business associate. HHS guidance on business associate agreements and certification.

What must a BAA define about permitted PHI uses and disclosures?

The BAA must describe the vendor’s permitted and required uses and disclosures of PHI. For chart retrieval, make the permitted purpose specific—for example, locating and obtaining medical record source documentation for an identified risk adjustment or audit-related workflow, then securely returning or submitting it as instructed. The agreement should also prohibit uses or disclosures outside those allowed by the BAA or required by law. HHS sample business associate contract provisions.

Address any additional uses expressly rather than relying on broad language. If the vendor may de-identify information, use it for internal management, or perform data aggregation, specify the permission and applicable limits. These are not automatic rights to use PHI for unrelated analytics, product development, marketing, or other clients’ work. HHS describes the permitted uses and the limits on what a BAA may authorize. HHS business associate guidance.

Set out how the minimum necessary standard will be applied when it applies: define the requested population, record types, relevant date ranges, and the purpose of each request. The standard generally calls for reasonable efforts to limit PHI to what is needed for the purpose, but it has specific exceptions, including certain disclosures to or requests by health care providers for treatment. Avoid describing it as an exception-free rule. HHS minimum necessary guidance.

How should the BAA specify chart retrieval scope and submission methods?

Translate the service description into an operational scope. Identify which records the vendor may request, from which providers or sources, for which individuals and periods, and whether the work includes locating records, following up on requests, indexing files, checking completeness, or submitting documents to a designated recipient. State what is outside scope, such as changing clinical documentation or using records for a separate purpose.

Specify approved methods for requesting, receiving, storing, and submitting records. Depending on the workflow, the service agreement or BAA can identify approved portals or other transfer channels, authorized users, file formats, naming conventions, and delivery destinations. Define how the vendor should handle misdirected, incomplete, duplicate, unreadable, or unexpectedly received records. These operational details help make the permitted service concrete; the BAA’s required core terms include describing the permitted and required PHI uses and disclosures. HHS sample business associate contract provisions.

Document the handoff points and responsibilities for confirming that a request is authorized and directed to the correct source. The agreement should not imply that the BAA alone compels a provider to release records or resolves other legal requirements that may apply to the disclosure. Align the workflow with the covered entity’s policies and the parties’ respective roles.

What privacy and confidentiality safeguards should the vendor follow?

Require appropriate safeguards to prevent unauthorized use or disclosure of PHI, and require the vendor to comply with applicable HIPAA Security Rule requirements for electronic PHI. In practical terms, your agreement can address role-based access, workforce authorization and termination of access, secure transfer and storage, incident response, and controls for paper records. The HIPAA Security Rule requires administrative, physical, and technical safeguards for electronic PHI; the specific safeguards should be evaluated in light of the vendor’s systems and risks. HHS Security Rule overview.

Include a process for reporting suspected or confirmed security incidents and impermissible uses or disclosures. Set a contractual notification period that allows the covered entity to investigate and meet its obligations. For a breach of unsecured PHI, HIPAA requires a business associate to notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery; the agreement may set a shorter operational deadline. HHS Breach Notification Rule guidance.

Address the end of the engagement: require the vendor, where feasible, to return or destroy PHI and retain no copies, and specify how any information that cannot feasibly be returned or destroyed will remain protected and restricted. Also provide for termination if the vendor materially violates the agreement, consistent with the BAA requirements. HHS sample business associate contract provisions.

How can the BAA support diagnosis traceability and audit trails?

Define the information the vendor must preserve so each retrieved record can be linked to the correct person, provider, encounter, and requested diagnosis or review item. Useful workflow fields may include the request identifier, source organization, date received, record period, document or page references, processing status, submission date, and any correction or resubmission history. These are practical traceability controls to consider in the agreement; they are not a universal HIPAA-prescribed field list.

Require the vendor to preserve the source record and distinguish it from indexing notes, summaries, or other vendor-created work products. If the vendor performs extraction or coding-related tasks, define exactly what it may record and how uncertainties, missing pages, or discrepancies must be flagged. Do not let workflow labels imply that a diagnosis has been clinically validated when the vendor was only assigned to retrieve documentation.

For Medicare Advantage RADV, CMS states that its audit confirms whether diagnoses submitted for risk adjustment are supported in enrollees’ medical records. Its medical record checklist gives examples of documentation issues and cautions that the guidance does not guarantee that a record will validate a diagnosis. Design the retrieval workflow to preserve complete, attributable source documentation and follow the applicable submission instructions, without treating retrieval itself as diagnosis validation. CMS Medicare Advantage RADV program and CMS RADV medical record checklist and guidance.

Specify which system or party maintains the authoritative audit trail and how the vendor will make relevant logs and records available for review. The HIPAA Security Rule includes a requirement to review information-system activity records, such as audit logs and access reports; use the agreement to clarify how the vendor supports the covered entity’s oversight and documentation needs. HHS HIPAA audit protocol.

Which vendor workflow and provider obligations should the agreement address?

Allocate responsibilities across the workflow. Identify who supplies accurate request data, confirms the retrieval purpose, communicates with providers, handles provider questions, resolves identity mismatches, reviews returned files, and submits records to the intended recipient. Include escalation paths and service deadlines, while making clear that contractual deadlines do not guarantee a provider will respond by a particular date.

List any subcontractors or service providers that may create, receive, maintain, or transmit PHI, and require the vendor to bind them to the applicable restrictions and conditions for PHI. HIPAA requires business associates to obtain the required written assurances from subcontractors, and HHS explains that the subcontractor arrangement must include applicable BAA provisions. HHS business associate and subcontractor guidance.

Set expectations for cooperation during audits, investigations, and individual-rights requests when relevant to the vendor’s role. The BAA should also cover access to the vendor’s relevant records by HHS for compliance purposes and explain how the vendor will assist the covered entity with its applicable duties. HHS sample business associate contract provisions.

In short, a useful risk adjustment chart retrieval vendor BAA connects the vendor’s actual role to narrowly defined PHI permissions, workable safeguards, traceable record handling, and clear responsibilities for the full retrieval chain. Review those terms with the service workflow so records can be retrieved and submitted securely without confusing documentation collection with diagnosis validation.

FAQs

Must a BAA be signed before sharing PHI with a chart retrieval vendor?

When the vendor is a business associate and the covered entity is disclosing PHI to it or allowing it to handle PHI on the entity’s behalf, the covered entity generally must have the required written contract or arrangement in place. Confirm the relationship and the applicable party-to-party agreement before PHI is shared; a certification or general assurance does not replace a compliant BAA. HHS guidance on the written BAA requirement.

What chart retrieval activities should a risk adjustment vendor BAA cover?

Describe the authorized retrieval purpose and the vendor’s permitted tasks, such as requesting records, following up with sources, receiving and indexing files, flagging incomplete documentation, and submitting records through approved channels. Define the relevant record scope, permitted PHI uses, safeguards, incident reporting, subcontractor obligations, and return or destruction at termination. Tailor the terms to the actual workflow rather than assuming every vendor performs the same tasks. HHS sample business associate contract provisions.

How should retrieved records support diagnosis traceability?

Preserve the source documentation and maintain enough context to connect it to the correct individual, provider, encounter, record period, and review item. Track when the record was requested, received, processed, and submitted, and flag missing or unclear material. For Medicare Advantage RADV, CMS checks whether submitted diagnoses are supported by medical records, but CMS guidance does not guarantee that any specific record will validate a diagnosis. CMS RADV program.

Are subcontractors required to follow the vendor’s BAA obligations?

When a subcontractor creates, receives, maintains, or transmits PHI on behalf of a business associate, the business associate must obtain the required written assurances that the subcontractor will follow the applicable restrictions and conditions for that information. The vendor should identify relevant subcontractors and manage the required flow-down obligations in its agreements with them. HHS business associate guidance.