What a HIPAA business associate agreement must contain before an automation vendor sees PHI

HHS defines a business associate as a person or entity outside the covered entity’s workforce that does work for it, or provides services to it, that involves access to PHI. A subcontractor that creates, receives, maintains, or transmits PHI for another business associate counts too (HHS sample BAA provisions).

A business associate is directly liable under the HIPAA Rules for uses and disclosures its contract does not authorize. It is also liable for failing to safeguard electronic PHI as the Security Rule requires.

In practice, this covers an automation vendor that submits claims, reads referral documents, or runs bots inside your EHR. It also covers the model provider or hosting service that vendor uses, which the fourth section explains. Our build and integration service is one example of the first kind.

HHS states that the written contract between a covered entity and a business associate must do the following. Contracts between a business associate and its subcontractors face the same requirements.

The ten elements set a floor. HHS’s own sample language marks several places where the parties choose their own terms, and those choices matter for automation.

Breach reporting. HHS notes that the parties may add a stricter timeframe for reporting a potential breach. They may also decide whether the business associate handles notifications to individuals, OCR, and the media. Ask for a number of days and a named owner for each notification.

Subcontractors. Every service that touches PHI on the vendor’s behalf needs the same terms as the vendor. For an automation build, that can include a model provider, a hosting service, a messaging service, and an OCR or document-processing service. Ask for the list.

De-identification. HHS says the parties should specify whether the business associate may use PHI to de-identify it. If your BAA is silent, ask the vendor in writing. Do not assume the answer.

Minimum necessary. The sample offers two options: follow the covered entity’s minimum necessary policies, or spell out specific limits. Automation steps often need far less data than the source record holds, so name the limits per workflow.

Termination. Ask where PHI lives outside the main database, such as logs, queues, and model prompts, and how the vendor returns or destroys it. The BAA element says return or destroy “if feasible,” so get the feasible answer in writing.

HHS’s cloud computing guidance says a cloud service provider is a business associate when a covered entity engages it to create, receive, maintain, or transmit electronic PHI. The same holds when a business associate subcontracts with the provider. It holds even if the provider stores only encrypted PHI and has no decryption key (HHS cloud guidance).

The practical result: an automation project needs a BAA with the vendor that builds it and one with wherever it runs. If it runs inside infrastructure you already hold a BAA for, the second one exists already.

The guidance also lists what a service level agreement can cover that bears on HIPAA. Those topics are availability, backup and data recovery, how data returns after termination, who holds security responsibility, and limits on use, retention, and disclosure. HHS adds that the SLA should stay consistent with the BAA.

A signed BAA does not make a workflow compliant. HHS’s cloud guidance says both covered entities and business associates must run a risk analysis of the threats and vulnerabilities to the ePHI they handle. The type of cloud setup can change that analysis.

HHS also states that using its sample provisions is not required. The sample may not be enough to form a binding contract under state law, and it does not replace a lawyer or negotiation between the parties. Have counsel review the final document. Audit questions come next: see our post on HIPAA audit preparation.

We sign a BAA before we look at a workflow, and we run most builds inside the client’s own cloud tenant so PHI stays in infrastructure the client controls. Every vendor that touches PHI goes into a subprocessor register with its BAA status. The controls are on our HIPAA and compliance page.