HIPAA business associate agreements: which to sign, which to issue, and the record that proves they work

What is a HIPAA business associate agreement for?

A HIPAA business associate agreement (BAA) is the contract that sits between a party holding protected health information and the vendor that will handle it on that party's behalf. It limits what the vendor may do with the PHI, commits it to Security Rule safeguards, and sets reporting and exit duties. The Security Rule lists business associate contracts as a required administrative safeguard (164.308(b)), and the Privacy Rule's organisational requirements (164.504(e)) set out what the contract must contain.

Since the 2013 Omnibus Rule, a business associate is directly liable for compliance with certain HIPAA requirements whether or not a contract exists. The agreement therefore does not create the obligation; it records who carries which duty, and it is among the first documents a vendor auditor requests. This guide is general information, not legal advice: a lawyer qualified in US health privacy law should draft and review every agreement you sign or issue.

Which agreements you sign and which you issue

The test HHS applies is functional. A business associate is a person that performs functions or activities for a covered entity that involve creating, receiving, maintaining or transmitting PHI. A subcontractor doing the same for a business associate is itself a business associate. Location is not part of the test, so a provider in the Philippines, India or the UAE is assessed on the same basis as one in the United States.

Agreements you sign

If you provide billing, coding, transcription, contact-centre, analytics, hosting or IT support to a US health plan, provider or clearinghouse, your client will send you its agreement. Each clause becomes something your people must do, often on a deadline.

Agreements you issue

Every vendor you rely on that creates, receives, maintains or transmits the same PHI needs an agreement from you, carrying the same restrictions and conditions you accepted. Cloud platforms, recording storage, analytics contractors and managed IT providers are typical.

Where no agreement is needed

HHS recognises exceptions: disclosures between health care providers for treatment, and pure conduits that only transmit PHI without storing it beyond what transmission requires. A vendor that never touches PHI is outside the definition. Where the answer is unclear, record the reasoning.

What the regulation requires the agreement to contain

HHS publishes sample agreement provisions that follow the regulation. The table sets each required element against the evidence an auditor would ask for.

On breaches, the Breach Notification Rule gives a business associate an outer limit of 60 days from discovery to notify the covered entity, and requires notice without unreasonable delay. A client agreement may set a shorter window; your incident procedure must be built to the contract, not to the regulation's ceiling.

A worked example: a contact centre's agreement map

Consider a 300-seat contact centre in Cebu that schedules appointments and answers billing queries for a group of US clinics. Agents use a cloud contact platform, calls are recorded and stored by a separate vendor, a small analytics firm scores call quality, and a local managed service provider administers the workstations.

The clinics' agreement requires incident reports within a set number of days. The centre's issued agreements must therefore require its own vendors to report faster, so the centre has time to assess and pass the report upward. At exit, the recording and analytics vendors must also return or destroy their copies, with confirmation on file.

The record: an agreement register that matches the data flows

A signed PDF proves an agreement exists, not that every party handling PHI has one or that its promises are kept. The record that answers both is a register built from the PHI data-flow map, one line per party:

• the party, its service and the PHI it handles, with a link to the relevant data flow;
• the direction (signed or issued), the agreement version, signature date and renewal or review date;
• the reporting deadline the agreement sets and the contact route for reports;
• the evidence you hold on the vendor's safeguards, such as a completed questionnaire, a SOC 2 report or an ISO/IEC 27001 certificate with its scope checked;
• at termination, the date and evidence of return or destruction.

Treat the register and the agreements as required documentation and keep them for six years from creation or the date they were last in effect, whichever is later. The Security Rule update proposed in January 2025 would add a written verification of business associates' safeguards at least every twelve months; it remains a proposal, and The proposed Security Rule update, explained covers its status.

Business associate agreement mistakes that surface in audits

• Agreements in one direction only. The client's agreement is signed, but no agreement has been issued to the cloud or analytics vendors downstream. Business associate agreement gaps recur in HHS resolution agreements.
• Deadlines nobody can meet. A reporting window of a few days is accepted while the internal incident procedure still assumes weeks.
• A register that does not match reality. A new tool, a trial vendor given live data or a mid-contract subcontractor never reaches the register.
• Copied templates. A generic agreement downloaded and signed without a lawyer's review, or edited in ways that remove required elements.
• Forgotten exits. Contracts end, but nobody asks for confirmation that PHI has been returned or destroyed by the vendor or its subcontractors.

Each business associate also belongs in your risk analysis; see The Security Rule risk analysis: how to conduct one.

HIPAA business associate agreements: questions buyers ask