Most HIPAA business associate agreements are signed from a template, filed and never read again, so the clauses that decide what happens in a breach, a vendor exit or an audit are rarely tested until it is too late. A business associate agreement (BAA) is the contract HIPAA requires before a covered entity lets a vendor create, receive, maintain or transmit protected health information (PHI) on its behalf, and the same duty runs down every subcontractor in the chain. This guide explains who is and is not a business associate, the terms 45 CFR 164.504(e) requires clause by clause, how subcontractor, cloud and AI vendor arrangements work, and how to run BAAs as a managed lifecycle rather than paperwork. It is written for privacy, security, procurement and legal teams at providers, health plans, clearinghouses and the vendors that serve them. For the safeguards themselves see the HIPAA Security Rule Guide.
Source note: this page summarises the official text and the sources listed at the end. Confirm against the official text before relying on it.
Key takeaways
- The trigger is PHI, not the contract value. Any person or organisation outside the workforce that creates, receives, maintains or transmits PHI for a covered entity's regulated function is a business associate under 45 CFR 160.103, whether or not a BAA has been signed.
- Ten terms are mandatory. 45 CFR 164.504(e)(2) fixes permitted uses, safeguards, reporting, subcontractor flow-down, individual rights support, HHS access to records, return or destruction at termination, and a termination right.
- Every link in the chain needs its own agreement. A subcontractor that handles PHI for a business associate is itself a business associate, and the business associate must sign a BAA with it on the same terms (164.504(e)(5)).
- Encryption does not take a cloud vendor out of scope. HHS states that a cloud provider storing encrypted ePHI without the key is still a business associate, and the conduit exception is narrow.
- Business associates are directly liable. HHS lists ten areas where OCR can act against a business associate itself, including Security Rule compliance, breach notification and subcontractor BAAs.
Who is a business associate, and who is not
45 CFR 160.103 defines a business associate as a person who, other than as a workforce member, creates, receives, maintains or transmits PHI on behalf of a covered entity for a regulated function or activity (claims processing, data analysis, utilisation review, quality assurance, billing, benefit management, practice management and similar), or who provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial services that involve disclosure of PHI. A covered entity can itself be a business associate of another covered entity.
| Relationship | Business associate? | Basis |
|---|---|---|
| Billing company, coding service, revenue cycle vendor | Yes | Regulated function on behalf of the covered entity, 160.103 (1)(i) |
| EHR, practice management or patient portal SaaS | Yes | Maintains and transmits PHI on the covered entity's behalf |
| Cloud provider storing ePHI, even encrypted without the key | Yes | HHS cloud computing guidance: lacking the key does not remove BA status |
| Law firm, auditor, consultant or managed security provider with PHI access | Yes | Professional services involving PHI disclosure, 160.103 (1)(ii) |
| Health information organisation, e-prescribing gateway | Yes | Named in 160.103 (3)(i) where it has routine access to PHI |
| Vendor offering a personal health record on the covered entity's behalf | Yes | 160.103 (3)(ii) |
| Subcontractor of a business associate handling PHI (hosting, backup, shredding, support) | Yes | 160.103 (3)(iii) |
| Another provider receiving PHI for the patient's treatment | No | Excluded by 160.103 (4)(i) |
| Plan sponsor receiving PHI from a group health plan under 164.504(f) | No | Excluded by 160.103 (4)(ii) |
| Pure transmission service with only transient storage (the conduit exception) | Usually no | HHS cloud guidance: applies only to transmission with temporary storage incident to it |
- Function test, not label test: ask what the vendor does with PHI. An analytics platform ingesting claims data is a business associate; a cleaning contractor who might glimpse a chart is not.
- Limited data sets: where only a limited data set is disclosed for health care operations, a data use agreement meeting 164.514(e)(4) can satisfy the requirement instead of a full BAA (164.504(e)(3)(iv)).
The required terms, clause by clause
The table maps each paragraph of 45 CFR 164.504(e)(2) to what the clause should say in practice and what to check when reviewing a vendor's paper. The same terms appear in the HHS sample business associate agreement provisions, which HHS says are not required wording and do not replace legal advice.
| 164.504(e)(2) | Requirement | What to check in the draft |
|---|---|---|
| (i) | Permitted and required uses and disclosures; nothing the covered entity could not do itself, except management and administration and data aggregation | Uses tied to the service agreement; no open "to improve our services" clause covering PHI |
| (ii)(A) | No use or further disclosure beyond the contract or as required by law | Secondary use, sale and marketing excluded; de-identification rights stated explicitly if granted |
| (ii)(B) | Appropriate safeguards; comply with Subpart C (Security Rule) for ePHI | Named safeguards such as MFA, encryption and logging, not only "industry standard" |
| (ii)(C) | Report uses or disclosures not provided for, including breaches of unsecured PHI under 164.410 | Security incident definition, reporting clock, contact route, content of notice |
| (ii)(D) | Subcontractors agree to the same restrictions and conditions | Flow-down obligation, list or notice of subcontractors, right to object |
| (ii)(E) to (G) | Support access (164.524), amendment (164.526) and accounting of disclosures (164.528) | Turnaround times that let the covered entity meet its own deadlines |
| (ii)(H) | Comply with Privacy Rule requirements when carrying out the covered entity's obligation | Relevant for vendors that send notices or handle patient requests |
| (ii)(I) | Make internal practices, books and records available to HHS | Not limited by confidentiality clauses in the master agreement |
| (ii)(J) | At termination return or destroy all PHI if feasible, retain no copies; if infeasible, extend protections and limit further use | Return format, destruction standard, certificate, backups and subcontractor copies covered |
| (iii) | Covered entity may terminate for violation of a material term | No clause that makes termination conditional on vendor consent |
Two further rules sit around the clause list. Under 164.504(e)(1)(ii), a covered entity that knows of a pattern of activity or practice by its business associate amounting to a material breach is out of compliance unless it takes reasonable steps to cure the breach or end the violation and, if that fails, terminates the arrangement where feasible. Under 164.504(e)(4), the contract may let the business associate use PHI for its own proper management and administration and legal responsibilities, and disclose it for those purposes only where required by law or with reasonable assurances of confidentiality from the recipient. The Security Rule repeats the safeguard, subcontractor and incident reporting terms for ePHI in 45 CFR 164.314(a).
Optional terms worth negotiating
- Breach reporting clock: the rule allows a business associate up to 60 calendar days after discovery to notify the covered entity (164.410(b)). HHS's sample provisions explicitly allow a stricter timeframe; many covered entities set a short initial notice measured in days or hours with details to follow, because the covered entity's own 60-day clock to individuals can start when its agent discovers the breach.
- Who notifies: individuals, HHS and the media, and who pays.
- Audit and evidence rights: HIPAA does not require a vendor to provide security documentation or allow audits; the HHS cloud guidance says customers can require these by contract.
- Regulatory change: an amendment clause so the BAA can be updated if the proposed Security Rule changes are finalised.
Subcontractor chains
Since the 2013 Omnibus Rule, liability follows the PHI. A subcontractor is anyone to whom a business associate delegates a function, activity or service, other than its own workforce (160.103). If that subcontractor creates, receives, maintains or transmits PHI, it is a business associate in its own right, and 164.504(e)(5) applies the full set of contract requirements to the business associate and subcontractor agreement.
- No direct contract with the covered entity: the covered entity does not need a BAA with its vendor's subcontractors. The business associate does, and HHS lists failure to obtain those agreements among the business associate's direct liabilities.
- Same cure or terminate duty: 164.504(e)(1)(iii) puts the business associate in the covered entity's position towards a subcontractor that materially breaches its agreement.
- Visibility for the covered entity: nothing obliges a vendor to disclose its subcontractors, so require a list, change notice and confirmation of downstream BAAs. Hosting, support desks, offshore teams and AI model providers are where PHI travels unseen.
See the Third-Party Risk Management Guide.
Cloud, SaaS and AI vendors
HHS's cloud computing guidance is the clearest statement of how BAAs apply to modern services, and its logic carries over to AI tools.
| Scenario | HHS position or rule | Contract points |
|---|---|---|
| IaaS or storage holding encrypted ePHI, customer holds the key ("no-view" service) | Still a business associate; encryption does not cover integrity, availability or administrative and physical safeguards | Written split of responsibilities for access controls; the provider still controls its admin tooling |
| Covered entity uses a cloud provider without a BAA | The covered entity or business associate violates the HIPAA Rules; the provider is still bound once it maintains ePHI | Find these through spend and SSO data, not only procurement records |
| Provider learns it is holding ePHI unknowingly | Affirmative defence if it corrects non-compliance within 30 days of when it knew or should have known, absent wilful neglect | Contractual route to sign a BAA or return the data quickly |
| Offshore storage or support | Permitted with a BAA; location risks belong in the risk analysis | Data location clause, support access locations, subcontractor disclosure |
| Service levels | SLAs must be consistent with the BAA; the provider must not block the customer's access to ePHI in breach of the Rules | Availability, backup and recovery including ransomware, data return format and timing |
| AI scribe, coding assistant, chatbot or analytics model processing PHI | Business associate under the 160.103 function test; no AI-specific exemption exists | Training on PHI prohibited unless expressly agreed; prompt and output retention; model provider as a named subcontractor |
- Consumer AI tools: staff pasting patient details into a general-purpose chatbot that has no BAA is an impermissible disclosure in practice. Route clinical AI use to tools under a BAA and block the rest. See the AI Security in Healthcare Guide.
- Secondary use and training: the permitted uses clause under (e)(2)(i) governs whether a vendor can use PHI to train or tune models. If it is silent, the vendor has no permission; say so explicitly, and if de-identified training is allowed, require de-identification under 164.514(a) to (c).
For wider AI contract terms, see the AI Contract Clauses Guide.
Direct liability and enforcement
HHS's business associate direct liability fact sheet (published May 2019) lists the areas where OCR can take enforcement action against a business associate itself, and states that OCR can act against business associates only for these.
The ten areas are: failing to cooperate with HHS investigations or provide records; retaliation; Security Rule non-compliance; failing to notify the covered entity or upstream business associate of a breach; impermissible uses and disclosures; failing to provide an electronic copy of ePHI as the BAA requires for an access request; failing to apply minimum necessary; in certain circumstances failing to provide an accounting of disclosures; failing to sign BAAs with subcontractors; and failing to act on a subcontractor's material breach.
Covered entities remain liable for disclosing PHI without a BAA. In 2016 OCR announced a $750,000 settlement with Raleigh Orthopaedic Clinic, which handed X-ray films and PHI for about 17,300 patients to a vendor that offered to digitise them in exchange for the silver, without a BAA. OCR's director called BAAs "more than a mere check-the-box paperwork exercise". HHS's cloud guidance also cites a resolution agreement with Oregon Health & Science University involving ePHI stored on a cloud server without a BAA.
What may change: the proposed Security Rule update
HHS published a notice of proposed rulemaking on 6 January 2025 (90 FR 898). As checked on HHS's NPRM page on 11 November 2026, no final rule is shown and HHS states that "the current Security Rule remains in effect". The proposal is not law. According to HHS's NPRM fact sheet, it would require business associates to provide written verification, at least every 12 months, that they have deployed required technical safeguards, based on a written analysis by a subject matter expert and a certification, and to notify covered entities within 24 hours of activating their contingency plans, with the same duties flowing from subcontractors to business associates. For status tracking see the HHS HIPAA Security Rule Update (2025 NPRM) Guide.
Where identity fits
A BAA describes safeguards on paper; the vendor's actual access to PHI runs through accounts, tokens and integrations that the covered entity usually issues.
- Vendor human accounts: named accounts with MFA for every vendor engineer or support agent, no shared logins, access tied to the BAA's term and removed at termination. See the Contractor Identity Lifecycle Guide.
- Integration credentials: API keys, OAuth clients and service accounts that connect EHRs to billing, analytics or AI vendors are non-human identities with PHI scope. Inventory them per BAA, scope them to the permitted uses, rotate them, and revoke them on exit.
- Remote access paths: vendor VPN, remote support and jump host access are where business associate compromises turn into covered entity compromises. The Change Healthcare breach, which began with a remote access login without MFA, shows how one vendor's credential failure can disrupt thousands of downstream organisations.
- Evidence: access reviews of vendor identities evidence the (ii)(B) safeguard clause. See the Healthcare Identity Security Guide.
Running BAAs as a lifecycle
- Inventory PHI flows: reconcile procurement, accounts payable, SSO application lists, egress and DLP findings with the BAA register, and record the 160.103 basis for each vendor in or out of scope.
- Standardise the paper: one template with a preferred and minimum position per clause and a named approver for deviations; review vendor paper against the clause table above.
- Tier vendors: PHI volume, access method, offshore elements and AI use set the depth of due diligence and the reporting clock you insist on.
- Sign before data flows: make an executed BAA a technical gate for provisioning accounts, keys and data feeds. Pilots with real PHI count.
- Monitor during the term: annual evidence requests, subcontractor list refresh, incident contact tests and access reviews of vendor identities.
- Act and record: document known material breaches, cure steps and any termination decision to show you met 164.504(e)(1)(ii).
- Exit cleanly: destruction certificates covering backups and subcontractors, all credentials revoked, and any infeasible return documented with continuing protections.
Decision guidance by size
- Small practice: a few dozen vendors at most. Start from the HHS sample provisions, keep a simple register, and focus on the EHR, billing, IT support, backup and any AI scribe vendor.
- Hospital system or health plan: hundreds of BAAs. Store them in a contract system with clause-level metadata (reporting clock, training rights, offshore, subcontractor notice) so you can answer "which vendors may use PHI for AI training" in minutes.
- Vendor side: keep a standard BAA, a current subcontractor list and downstream BAAs in place before onboarding health customers.
Detection and measurement
- BAA coverage: percentage of PHI-handling vendors and integrations with an executed BAA or documented exclusion; target 100 percent.
- Shadow vendors found: count of PHI flows discovered through SSO, egress or DLP data with no BAA, and time to resolve.
- Reporting clock compliance: median time from vendor discovery to notice received, compared with the contractual clock.
- Exit completeness: share of terminated vendors with destruction certificates and all credentials revoked within 30 days (NHI Mgmt Group recommendation).
- Vendor identity hygiene: share of vendor accounts and integration credentials with an owner, MFA where human, and review in the last 12 months.
Framework mapping
| BAA element | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Due diligence before signing | GV.SC-06 | SR-6 Supplier Assessments and Reviews | 5.19 Information security in supplier relationships |
| Security terms in the agreement | GV.SC-05 | SA-4 Acquisition Process; SA-9 External System Services | 5.20 Addressing information security within supplier agreements |
| Subcontractor flow-down | GV.SC-05 | SA-9 External System Services | 5.21 Managing information security in the ICT supply chain |
| Incident and breach reporting | GV.SC-08 | IR-6 Incident Reporting | 5.24 Information security incident management planning and preparation |
| Vendor personnel access | PR.AA-05 | PS-7 External Personnel Security | 5.22 Monitoring, review and change management of supplier services |
Common failure patterns
- No BAA because "they only store it encrypted": HHS has said plainly that a cloud provider without the key is still a business associate.
- Data flows before signature: a pilot or proof of concept goes live with real PHI while legal is still negotiating, which is exactly the Raleigh Orthopaedic pattern.
- The 60-day default left in place: a BAA that mirrors the regulatory maximum leaves the covered entity learning of a breach weeks after its own clock may have started.
- Silent on AI and secondary use: no clause on training, de-identification or model provider subcontractors, so nobody can say where prompts containing PHI end up.
- Termination that ends the contract but not the access: the BAA lapses while vendor accounts, API keys and data feeds keep working, and backups at subcontractors are never destroyed.
Practitioner checklist
- Build a PHI flow inventory from procurement, SSO, egress and DLP data and reconcile it with the BAA register.
- Record the 160.103 basis for every vendor classified as in or out of scope.
- Review every BAA against the ten 164.504(e)(2) terms and your fallback positions.
- Set a contractual breach and security incident reporting clock shorter than the 60-day maximum.
- Require a subcontractor list, change notice and confirmation of downstream BAAs.
- Add explicit terms on AI training, de-identification, prompt and log retention for AI vendors.
- Gate account, key and data feed provisioning on an executed BAA.
- Review vendor human and non-human identities with PHI access at least annually.
- Collect destruction certificates and revoke all credentials at exit.
- Add a regulatory change clause and track the Security Rule NPRM.
Standards and references
- eCFR: 45 CFR 164.504 Uses and disclosures: organizational requirements
- eCFR: 45 CFR 160.103 Definitions
- eCFR: 45 CFR 164.410 Notification by a business associate
- HHS: Sample Business Associate Agreement Provisions
- HHS OCR: Direct Liability of Business Associates
- HHS OCR: Guidance on HIPAA and Cloud Computing
- HHS OCR: HIPAA Security Rule NPRM Fact Sheet
- HHS OCR: Raleigh Orthopaedic Clinic settlement bulletin
This guide summarises the HIPAA business associate requirements in 45 CFR Parts 160 and 164 and the status of the proposed Security Rule update as of 11 November 2026, and is not legal advice. Related NHI Mgmt Group resources: HIPAA Security Rule Guide · HIPAA Breach Notification Rule Guide · Third-Party Risk Management Guide · Healthcare Cyber Regulation Map