A business associate agreement is the licence to touch someone else's PHI.

A business associate performs a function or service for a covered entity that involves PHI, outside the entity's own workforce. A subcontractor does the same for a business associate. Both need an agreement upstream, and both are directly liable for parts of HIPAA.

1. The covered entity signs with its direct vendor, the business associate.
2. That business associate signs with each subcontractor that touches the PHI, on terms at least as strict.
3. Each subcontractor signs with its own subcontractors, and so on down the chain.

Large cloud providers publish a standard agreement and a list of services it covers. Check the provider's current list, and keep PHI out of any service not on it.

• Purposes. What the vendor may and must do with PHI, and nothing the covered entity could not do itself.
• Use limits. No use or disclosure beyond the contract or what law requires.
• Safeguards. Appropriate safeguards, and compliance with the Security Rule for ePHI.
• Reporting. Report any use not allowed by the contract, security incidents, and breaches of unsecured PHI.
• Flow-down. Subcontractors agree to the same restrictions and conditions.
• Patient rights support. Make PHI available for access, amendment and an accounting of disclosures.
• Stepping into the shoes. Follow the Privacy Rule when doing a covered entity's own Privacy Rule tasks.
• HHS access. Open internal practices, books and records to HHS.
• End of contract. Return or destroy PHI, keeping no copies, or extend protection where that is not feasible.
• Right to terminate. The covered entity may end the contract if the vendor breaches a material term.

If a covered entity learns of a pattern of activity by its vendor that materially breaches the agreement, it must take reasonable steps to cure it, and terminate where feasible if that fails. A business associate owes the same duty about its subcontractors. Staying silent about a known problem makes the upstream party non-compliant too.

At the end, PHI goes back or is destroyed, including copies in backups. Where that is genuinely infeasible, for example data locked in immutable archives until they expire, the agreement's protections keep running for as long as the data exists, and use is limited to the reason it could not be removed.

• A tool with no agreement. Logging, chat, transcription or AI services that quietly receive PHI with no BAA in place.
• Uncovered services. A signed cloud agreement, but PHI stored in a service outside the provider's covered list.
• Over-broad subcontracting. Upstream terms allow any subcontractor, with no notice to the customer and no matching flow-down.
• Promises you cannot keep. Accepting a 24-hour breach notice window with no on-call process to meet it.
• No vendor register. No list of which agreements exist, which data each vendor holds, and when it was last reviewed.
• Treating the BAA as proof. A signed agreement shows a promise, not that safeguards exist.

Illustrative clause checklist for a vendor reviewing a customer's paper

• Do the permitted purposes cover everything we actually do, including support, backups and de-identification?
• Is the breach and incident notice window one our on-call process can meet?
• Does it define security incident so that routine blocked scans need not be reported one by one?
• Are subcontractor approval terms workable for our current vendor list?
• Is the return-or-destroy duty achievable given our backup retention?
• Are audit rights, indemnities and insurance terms within what we can carry?

Sources: 45 CFR 160.103 (business associate and subcontractor); 45 CFR 164.502(e), 164.504(e) and 164.314(a) (business associate contracts); 45 CFR 164.410 (business associate breach notice); HHS sample business associate agreement provisions and guidance on HIPAA and cloud computing. This page is not legal advice.