Do we need a business associate agreement with this supplier, and what must it say about security?

Start

A supplier may reach our patient information

Decide the role before you negotiate anything. The role comes from what the supplier does with protected health information for you, not from whether a contract has been signed. A signed agreement does not make a supplier a business associate if it does nothing with PHI, and a missing one does not mean it is not one if it does. Start from the service, the data it will reach and where.

• Then: Can it create, receive, maintain or transmit our PHI, in any form?

Decision

Can it create, receive, maintain or transmit our PHI, in any form?

Ask this for the service as it will really run. Protected health information (PHI) counts in any form, electronic or not. A cloud provider that stores or processes your PHI is on HHS's list of business associates, as is an IT or managed service contractor whose support needs that access and a consultant, accountant or attorney whose services involve PHI. A ticketing tool that holds tickets quoting patient details is in scope by what it does. If you cannot say what it will hold, answer yes.

• Yes, or not known: Does an exception clearly apply?
• No: No agreement: write down how ePHI is kept out

Outcome

No agreement: write down how ePHI is kept out

If the supplier truly never reaches PHI, no business associate agreement is needed. Write down how that is enforced, for example tickets kept clean of patient details, and keep the note with the supplier's record. The test is what the supplier does with PHI, so ask the question again when the service changes.

Decision

Does an exception clearly apply?

The definition has narrow exceptions, and HHS adds situations where neither party acts for the other. The pack's short list: a disclosure to a health care provider for the treatment of the individual; a person with only incidental access and reasonable safeguards in place; a conduit that only transmits PHI with at most temporary storage; a provider and a health plan each acting on its own behalf. A person that reaches PHI regularly to do a service is not a conduit. If it is not clear, answer no and ask counsel.

• No, or not known: Place the supplier in the chain and ask counsel to confirm
• Yes: No agreement needed: record the exception and counsel's view

Outcome

No agreement needed: record the exception and counsel's view

Record which exception applies and the facts it rests on, and have counsel confirm it. The exceptions describe particular disclosures, so a different use needs the question asked again. If the service later grows to store, process or regularly reach PHI, ask this question again. The supplier assessment steps still apply to any supplier.

Step

Place the supplier in the chain and ask counsel to confirm

If you are a covered entity, the supplier is your business associate. If you are a business associate, a supplier that handles ePHI for you is your subcontractor, and it is a business associate too. You need the agreement with it, with the same content as the one above you. A covered entity is not required to obtain assurances from its business associate's subcontractors (164.308(b)(1)), but its risk analysis covers the ePHI held for it wherever it is, so ask for the list. If you are not sure of your own role, that is “Is our organisation a HIPAA covered entity, a business associate, or neither?”.

• Then: Is a written agreement signed before any ePHI moves?

Decision

Is a written agreement signed before any ePHI moves?

No ePHI goes to a business associate, and a business associate sends none to a subcontractor, before a written agreement is in place with the content the Security Rule asks for. A trial that uses live patient data counts as ePHI shared. If you cannot show a signed agreement dated before the first transfer, answer no.

• Yes: Check the agreement against the security terms
• No, or not known: Stop sharing ePHI and ask counsel for the agreement

Step

Stop sharing ePHI and ask counsel for the agreement

Where ePHI already flows without an agreement, treat it as a gap to fix at once, get the amendment quickly and tell the executive sponsor. Do not call the supplier outside the Rules because the paper is missing. Counsel drafts or adapts the agreement. This flow is not a template and the pack holds no clause text to paste. Assess the supplier through the supplier steps at the same time.

• Then: Check the agreement against the security terms

Step

Check the agreement against the security terms

Complete the review form once for each agreement, noting where each term sits. The terms include: the supplier complies with the Security Rule and uses appropriate safeguards; its subcontractors agree to the same, in writing and before PHI moves; it reports security incidents and impermissible uses, and gives the content of a breach notice; the agreement says where ePHI is held; the covered entity can end it for violation; PHI comes back or is destroyed at the end. Add any common additions you want, such as audit rights or multi-factor authentication.

• Then: Are all the terms you need present in words a reader can find?

Decision

Are all the terms you need present in words a reader can find?

A term is present when the agreement asks for it in findable words and nothing elsewhere takes it back. Count results, not a single figure: one missing term the Rules ask for matters more than many present ones. Industry-standard security with no mention of the Security Rule is a warning, not a pass. Include the common additions you decided to ask for. If you cannot tell, answer no.

• Yes: Has counsel read the Privacy Rule terms and the whole agreement?
• No, partly or not known: Will the supplier add the missing terms?

Decision

Will the supplier add the missing terms?

Find out exactly what is refused, in writing. Most refusals are of a sentence, not of a principle. Offer a fallback that keeps the purpose, for example the supplier's own standard where its scope covers the service, or a standing summary for unsuccessful attempts. If a large supplier will only sign its own paper, run the review form against that paper and record what is missing. The clause library gives pushbacks and fallbacks.

• Yes: Get the amendment, then check the terms again
• No: Does counsel say the Rules ask for any missing term?

Step

Get the amendment, then check the terms again

Take the amended wording back through the review form before approval. The contract fixes the time for telling you of an incident or a breach. Do not set it here: the incident notification clause in your supplier contract library holds the contract time, and the breach notification rule sets the outer limit. Counsel's wording governs every clause.

• Then: Are all the terms you need present in words a reader can find? (back to an earlier step)

Decision

Does counsel say the Rules ask for any missing term?

Ask counsel which missing terms the Security Rule or the Privacy Rule asks for. The pack lists thirteen terms that a paragraph of the Rules asks for, and two more that rest on 164.504(e) as good practice. The sixteenth, where ePHI is held, and the common additions, such as audit rights, shorter incident notice, multi-factor authentication or exit help, are not asked for by name. The answer decides what you can trade. If counsel has not answered, or the missing terms are a mix, answer yes.

• Yes, or not known: Do not share ePHI: amend, change supplier or keep ePHI away
• No: only locations or common additions: Decide each missing term of that kind as a risk, then go on

Outcome

Do not share ePHI: amend, change supplier or keep ePHI away

For a term the Rules ask for, no ePHI goes until it is in place. The choices are an amended agreement, a different supplier, or not sending ePHI to that supplier. If ePHI already flows, get the amendment quickly and tell the executive sponsor. A refusal that blocks a service is also a business decision: the vendor owner and the executive who signs contracts decide on a change of supplier, with the security official's advice and counsel's. Never agree to share first and settle the paper later.

Step

Decide each missing term of that kind as a risk, then go on

A missing common addition is a risk decision, not a legal stop. The person the residual risk band names decides, and an accepted risk is recorded in your risk process and added to your risk analysis. If the supplier will not say where ePHI is held, record that in the risk analysis as an unknown and rate the unknown. Say what you asked for and what the supplier refused. Then go on to counsel's reading.

• Then: Has counsel read the Privacy Rule terms and the whole agreement?

Decision

Has counsel read the Privacy Rule terms and the whole agreement?

Some terms come from the Privacy Rule and are counsel's: what the supplier may do with PHI, support for access, amendment and accounting, and its own management and administration. Counsel also reads how the agreement ranks against the service contract. The security team marks them present or missing and does not judge the wording. If you do not know, answer no.

• Yes: Approve it: counsel and the contract signatory, security reviewed
• No, or not known: Ask counsel to read the Privacy Rule terms and the whole

Step

Ask counsel to read the Privacy Rule terms and the whole

Send counsel the completed form with the counsel's terms marked. Wait for counsel's reading before approval. The pack says what the Rules ask for, as a guide. Counsel decides what the agreement must say.

• Then: Approve it: counsel and the contract signatory, security reviewed

Step

Approve it: counsel and the contract signatory, security reviewed

Counsel and the executive who signs contracts approve it, and the security official has reviewed the security terms. A contract is never signed with a business associate that has not been through the supplier steps. Keep the signed copy and the completed form together, and enter the party on your supplier register before signature. For an agreement you already hold, run the same check and enter the result on the register.

• Then: Share ePHI only after signature; plan the exit now

Outcome

Share ePHI only after signature; plan the exit now

Set up access after the date of signature. Plan the exit now: notice, the return format, the last day of access, destruction including subcontractor copies and backups, and a written confirmation. A signed agreement is the written assurance the Rules ask for, once counsel has confirmed its content. It does not show the supplier is secure.