When Is a Business Associate Agreement Needed?

Most healthcare organizations rely on many outside parties that handle patient information. Under HIPAA, many of those parties are business associates, and the organization needs a Business Associate Agreement (BAA) in place before sharing PHI with them.

Who is a business associate?

A business associate is a person or organization that creates, receives, maintains, or transmits protected health information on behalf of a covered entity, or that provides certain services to a covered entity involving PHI (45 CFR 160.103).

Common examples include:

• Billing and coding companies
• IT service providers and managed service providers with system access
• EHR, practice management, and cloud software vendors
• Cloud storage, email, and backup providers
• Transcription and answering services
• Document storage and shredding companies
• Consultants, accountants, and attorneys who need PHI for their work

Subcontractors of business associates that handle PHI are also business associates, and the business associate needs its own agreement with them.

Who usually is not

• Your own workforce. Employees, volunteers, and trainees under your direct control are part of your workforce, not business associates.
• Other providers, for treatment. Sharing PHI with another provider to treat a patient does not require a BAA.
• Conduits. Services that only transmit information and do not store it beyond temporary transmission, such as the postal service or an internet service provider, generally are not business associates.

Cloud services are a frequent source of confusion. HHS has said that a cloud service provider that stores electronic PHI is a business associate even if the data is encrypted and the provider does not have the key. See HHS's guidance on cloud computing.

What the agreement must include

HIPAA specifies required content for BAAs (45 CFR 164.504(e)), including that the business associate will:

• Use and disclose PHI only as the agreement permits or as required by law
• Implement Security Rule safeguards for electronic PHI
• Report uses or disclosures not permitted by the agreement, including breaches of unsecured PHI
• Ensure its subcontractors agree to the same restrictions
• Make PHI available for patient access and amendment requests where applicable
• Return or destroy PHI at the end of the relationship, where feasible

HHS publishes sample business associate agreement provisions. Many organizations have counsel review agreements, particularly vendor-drafted ones.

Business associates have their own obligations

Business associates are directly liable for certain HIPAA requirements, including Security Rule compliance and breach notification to the covered entity. A vendor that handles PHI for several healthcare clients should expect those clients to ask for evidence of its safeguards.

Keeping track

The most common problem is not a missing clause. It is not knowing which vendors have PHI access at all. A practical vendor inventory records:

• Vendor name and service
• What PHI the vendor can access, and how
• Whether a BAA is in place, and where it is stored
• Agreement date and renewal or review date
• An internal owner for the relationship

Review the inventory when vendors are added or replaced, and at least annually. New software subscriptions, often signed up for by a single department, are a common way PHI ends up with a vendor nobody has reviewed.