Business Associate Agreement Security Terms

You are the covered entity

A health plan, a clearinghouse or a health care provider that sends ePHI to suppliers

Check the agreement a business associate offers or has signed, against all sixteen terms. Keep the result with the agreement.

You are a business associate

You handle ePHI for a covered entity (as the EXAMPLE does)

Two checks. First, the paper your customer gives you: can you keep what it promises (reporting, return, locations)? Second, the paper you hold with each of your subcontractors, against all sixteen terms.

You are a subcontractor

A business associate has given you ePHI to handle for it

Read the terms you are being asked to accept, and check that you can do each and show it. The same sixteen terms apply to your paper with the business associate. You also check the paper you hold with your own subcontractors.

A cloud service provider that stores or processes your ePHI for you

Yes

HHS lists a cloud service provider engaged to create, receive, maintain or transmit ePHI (such as to process or store it) on behalf of a covered entity or business associate. If a provider says it cannot read the data, counsel confirms its role. This document does not decide it.

An IT contractor or managed service provider whose maintenance or support needs it to create, receive, maintain or transmit ePHI

Yes

HHS lists this contractor or vendor. Remote support with elevated access is the usual case.

A support or ticketing tool that holds tickets quoting patient details

Yes, where it creates, receives, maintains or transmits ePHI for you

It is a subcontractor of a business associate, or a business associate of a covered entity, by what it does. A tool that holds no ePHI because tickets are kept clean of it is a different case: write down how that is enforced.

A consultant, accountant, attorney or utilisation reviewer whose services involve access to PHI

Yes

The services listed in 160.103 (legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, financial) make the person a business associate where the service involves disclosure of PHI to it. HHS gives a CPA firm and an attorney as examples.

A courier, postal service or network carrier that only transmits PHI, with at most temporary storage

No

HHS: the conduit exception is limited to transmission, including temporary storage. A person that accesses PHI on a regular or frequent basis to do a service is not a conduit.

A janitorial service or an electrician whose work does not involve PHI, with access only incidental

No

HHS: no agreement where the functions do not involve use or disclosure of PHI, access is incidental if at all, and reasonable safeguards are in place.

A specialist, laboratory or other health care provider that receives PHI for treatment of the individual

No

The first exception in the definition: disclosure by a covered entity to a health care provider for treatment.

A health plan that receives a claim from a provider, or pays it

No

HHS: each is acting on its own behalf. The same applies when a provider accepts a discounted rate to join a network.

Covered entity

May allow a business associate to create, receive, maintain or transmit ePHI for it only if it obtains satisfactory assurances, as 164.314(a) sets out, that the business associate will appropriately safeguard it. Documents the assurances in a written contract or other arrangement (164.308(b)(1) and (b)(3)).

The agreement with each business associate. It is not required to obtain the assurances from a business associate that is a subcontractor.

Checks the business associate's paper against BT-01 to BT-16.

Business associate

Does the same toward each subcontractor that handles ePHI for it: it may allow it only if it obtains satisfactory assurances, in accordance with 164.314(a), and documents them in a written contract (164.308(b)(2), (b)(3)). Is directly subject to the Security Rule (164.306(a) names covered entities and business associates; 42 U.S.C. 17931 applies it by statute).

The agreement with the covered entity, and a written agreement with each subcontractor, made before PHI is disclosed to it.

Checks the covered entity's paper for what it can keep (the reporting, return and location terms), and its own subcontractors' paper against BT-01 to BT-16.

Subcontractor

Is itself a business associate when it creates, receives, maintains or transmits PHI on behalf of the business associate. The contract with it has the same content as the contract above it (164.314(a)(2)(iii)). It has the same duty toward its own subcontractors, so the chain continues downward.

The agreement with the business associate above it.

Checks what it is being asked to do, and whether it can do it and show it.

Asked for by

164.314(a)(2)(i)(A); 164.504(e)(2)(ii)(B)

The business associate agrees to comply with the applicable requirements of Subpart C.

Usually drafted from: CL-01 Security requirements and standards

Look for

A promise by the business associate to comply with the applicable requirements of the Security Rule (Subpart C), for the electronic protected health information it creates, receives, maintains or transmits. The Security Rule is named, or its citation is given.

Red flags

"Industry-standard security" or "reasonable measures" with no mention of the Security Rule. A promise limited to the Privacy Rule. A promise that applies to "data" in general, so it is unclear that it reaches ePHI.

If it is missing

Do not send ePHI. Ask for the term by amendment before the agreement is approved.

Asked for by

164.504(e)(2)(ii)(B)

It agrees to use appropriate safeguards to prevent use or disclosure of PHI other than as the agreement provides. The Rule does not ask the agreement to state a standard; naming one is what lets you test the promise.

Usually drafted from: CL-01 Security requirements and standards

Look for

A promise to use appropriate safeguards to prevent use or disclosure of PHI other than as the agreement provides, and a statement of the standard the safeguards must reach: a schedule, a named policy or a named framework. A promise not to reduce the level of security during the term is the usual way to keep the standard from drifting.

Red flags

Safeguards "at the supplier's discretion". A standard held on a web page the supplier may change without notice. Safeguards promised for the supplier's own systems only, with the customer's data elsewhere.

If it is missing

Ask for the term and for the standard to be written down or attached. If the business associate offers its own security statement, read it against the risk analysis (A04) and attach the version you read.

Asked for by

164.314(a)(2)(i)(B); 164.504(e)(2)(ii)(D); 164.502(e)(1)(ii)

It must ensure that every subcontractor that creates, receives, maintains or transmits ePHI for it agrees by a written contract to follow the Security Rule's requirements, and agrees to the same restrictions on PHI.

Usually drafted from: CL-04 Sub-processors and subcontracting

Look for

A duty to ensure that every subcontractor that creates, receives, maintains or transmits ePHI for the business associate agrees, by a written contract, to follow the Security Rule's requirements and to the same restrictions and conditions that apply to the business associate for PHI. The agreement says who counts as a subcontractor.

Red flags

"Will use reasonable efforts to require". Affiliates and contractors outside the duty. A list of subcontractors with no duty to keep it current.

If it is missing

Ask for the term. Ask the business associate which subcontractors reach ePHI today (the flow-down check, below) and record the answer on the register.

Asked for by

164.314(a)(2)(i)(C)

It reports to the covered entity any security incident of which it becomes aware, including breaches of unsecured PHI. Good practice, which the Rule leaves to the contract: the agreement says what counts as reportable (for example, whether unsuccessful attempts are reported in summary), to whom, in what form and by when.

Usually drafted from: CL-07 Security incident notification

Look for

A duty to report to the covered entity any security incident of which the business associate becomes aware, including breaches of unsecured PHI. The agreement says what counts as reportable and how unsuccessful attempts are handled (for example, a standing summary), to whom the report goes (a role and a monitored address, not a person), in what form, and by when. The time is a drafting choice. For a breach of unsecured PHI it is no later than the outer limit in P09 RD-20; the Rule sets no time for other security incidents.

Red flags

Only "breaches" are reported. Only "confirmed" incidents are reported. The duty starts when the supplier "completes its investigation".

If it is missing

Ask for the term and for a named, monitored contact. The Rule asks that the contract provide for the report, so silence in the agreement is a gap in the agreement itself.

Asked for by

164.504(e)(2)(ii)(C); 164.410

It reports any use or disclosure of PHI not provided for by the agreement of which it becomes aware, including breaches of unsecured PHI.

Usually drafted from: CL-07 Security incident notification

Look for

A duty to report any use or disclosure of PHI not provided for by the agreement of which the business associate becomes aware, including breaches of unsecured PHI. It covers uses and disclosures by the business associate's own staff and subcontractors, as well as outsiders.

Red flags

Reports limited to "unauthorised access by a third party". A "material" or "harmful" qualifier. Reporting only on request.

If it is missing

Ask for the term. Counsel confirms the wording, because it connects the security reporting duty to the Privacy Rule paragraph.

Asked for by

164.410(c)

A breach notice identifies each individual affected where it can, and gives the covered entity the other available information it needs for its own notice, promptly as it becomes available. The agreement sets the time. It is no later than the outer limit P09 RD-20 holds, and may be shorter.

Usually drafted from: CL-07 Security incident notification; CL-11 Cooperation in our incident response

Look for

What a breach notice contains: the identity of each affected individual where the business associate can give it, and the other available information the covered entity needs for its own notice to individuals, supplied promptly as it becomes available. The agreement sets the time. The time is no later than the outer limit in P09 RD-20, and may be shorter. The agreement says from when the time runs, and "discovery" is defined as in P09 IM-13.

Red flags

The time runs from "confirmation" or from the end of an investigation. No duty to identify individuals. A duty to give information "if known" with no follow-up.

If it is missing

Ask for the term. Name the time in the agreement, set by the covered entity's own plan for meeting its notices (P09, P18-A09).

Asked for by

164.504(e)(2)(i); 164.504(e)(2)(ii)(A); 164.504(e)(4)

The agreement says what the business associate may and must do with the PHI and does not allow what the covered entity could not do, except proper management and administration and data aggregation where the agreement allows them. Counsel's term.

Usually drafted from: No clause in the library. Counsel drafts it.

Look for

A statement of what the business associate may and must do with the PHI. It allows nothing the covered entity could not do itself, except proper management and administration of the business associate and data aggregation, where the agreement allows them. Use and disclosure are limited to what the agreement permits or the law requires.

Red flags

"Any lawful purpose". Rights to use the data to improve or develop the supplier's products. Rights to de-identify, aggregate or sell, stated loosely.

If it is missing

Counsel's term. Mark what you found and refer it.

Asked for by

164.504(e)(2)(ii)(E) to (G)

The business associate makes PHI available for individual access, for amendment and for the accounting of disclosures, as the Privacy Rule requires. Counsel's term.

Usually drafted from: No clause in the library. Counsel drafts it.

Look for

A duty to make PHI available for individual access, for amendment (and to incorporate amendments), and for the accounting of disclosures, as the Privacy Rule requires. The security team's check is practical: whether the service can produce a person's records, correct them, and list disclosures made.

Red flags

"Not supported by the service". No time or method for passing a request to the other party. No record of disclosures kept by the service.

If it is missing

Counsel's term. Refer the wording.

Asked for by

164.504(e)(2)(ii)(H)

If the business associate carries out an obligation of the covered entity, it follows the requirements that apply to the covered entity in doing so.

Usually drafted from: No clause in the library. Counsel drafts it.

Look for

Where the business associate carries out an obligation of the covered entity under the Privacy Rule (for example, sending a notice on its behalf), a promise to follow the requirements that apply to the covered entity in doing so.

Red flags

The service does carry out a covered-entity function and the agreement is silent. A function added later through a service order and no change to the agreement.

If it is missing

If the service carries out no such obligation, mark Not applicable with the reason. If it does, ask for the term.

Asked for by

164.504(e)(2)(ii)(I)

The business associate makes its internal practices, books and records on PHI available to the Secretary of Health and Human Services.

Usually drafted from: CL-17 Cooperation with competent authorities

Look for

A promise to make the business associate's internal practices, books and records on the PHI available to the Secretary of Health and Human Services. It is not conditional on the covered entity's consent.

Red flags

Access to books and records only for the covered entity's own auditors. A confidentiality clause that appears to bar giving records to a regulator. A duty only "as required by law".

If it is missing

Ask for the term. It is short, and suppliers that serve other covered entities usually have it already.

Asked for by

164.504(e)(2)(ii)(J)

At termination the business associate returns or destroys all PHI, if feasible, and keeps no copies. If it is not feasible, the protections continue and further use is limited to the reasons return or destruction is not feasible.

Usually drafted from: CL-13 Data return and deletion; CL-14 Exit and transition assistance

Look for

At termination, a duty to return or destroy all PHI the business associate still maintains in any form, and to keep no copies. If that is not feasible, the protections of the agreement continue and further use is limited to the reasons return or destruction is not feasible. The agreement says how soon, in what format, how backups are treated, how a subcontractor's copies are treated, and what written confirmation you receive. The Rule asks for return or destruction, where feasible, and names no method of destruction; a sound clause follows the method HHS's guidance sets for secured PHI: shredding or destruction of paper so that PHI cannot be read or reconstructed (redaction is not destruction), and clearing, purging or destroying electronic media consistent with NIST SP 800-88 so that the PHI cannot be retrieved.

Red flags

"May retain for backup, legal or business purposes" with no limit. Backups kept until they roll off with no end stated. Deletion described as "logical" or "deactivation".

If it is missing

Ask for the term. Add a return format and a date (BC-08).

Asked for by

164.504(e)(2)(iii)

The covered entity can end the agreement if it determines the business associate has violated a material term.

Usually drafted from: CL-15 Termination rights for security reasons

Look for

A right for the covered entity to end the agreement if it determines that the business associate has violated a material term. The right turns on the covered entity's own determination. The agreement also says what happens to the service when the agreement ends.

Red flags

Termination only after the supplier agrees there is a violation. A cure period that restarts. A right that belongs only to the supplier.

If it is missing

Ask for the term. Counsel reads it with the main service contract, because the two must end together.

Rests on

164.504(e)(1)(ii), (iii)

Where the covered entity knows of a pattern of activity or practice of the business associate that is a material breach of its obligations, it takes reasonable steps to cure it and, if that fails, ends the agreement if feasible; a business associate does the same toward its subcontractor. The agreement gives the right and the procedure.

Usually drafted from: CL-15 Termination rights for security reasons; CL-19 Remediation of assessment findings

Look for

Where the covered entity knows of a pattern of activity or practice of the business associate that is a material breach of its obligations (and, one link down, where the business associate knows of one by its subcontractor), a duty to take reasonable steps to cure it and, if that fails, to end the agreement if feasible. The agreement gives the right and a procedure: notice, a cure period, who decides, what evidence counts.

Red flags

No right for the covered entity to end the agreement over a known pattern, and no matching right for a business associate over its subcontractor. "If feasible" is left to the supplier. No procedure.

If it is missing

Ask for the term. Keep a record of what you know about the supplier's practices (audit notes, incident reports, assessment findings), because the duty turns on what you knew and what steps you took.

Rests on

164.504(e)(4)

If the agreement lets the business associate use or disclose PHI for its own management and administration or its legal responsibilities, it says so, and requires reasonable assurances of confidentiality from anyone it discloses to. Counsel's term.

Usually drafted from: No clause in the library. Counsel drafts it.

Look for

If the agreement lets the business associate use or disclose PHI for its own proper management and administration or to carry out its legal responsibilities, it says so, and it requires reasonable assurances of confidentiality from anyone the business associate discloses to (the person will hold it confidentially, use or disclose it only as required by law or for the purpose it was given, and tell the business associate of any breach of confidentiality). Disclosure required by law needs no such assurance.

Red flags

"Business purposes" in place of the two purposes the Rule names. Disclosure to affiliates or advisers with no assurance. No duty on the recipient to tell the business associate of a breach.

If it is missing

Counsel's term. If the agreement gives no such permission at all, mark Not applicable, with the reason.

Asked for by

164.308(b)(2); 164.314(a)(2)(iii); 164.504(e)(5)

The business associate holds a written agreement with the subcontractor, with the same content, before it discloses PHI to it.

Usually drafted from: CL-04 Sub-processors and subcontracting

Look for

A statement that the business associate holds a written agreement with each subcontractor, with the same content, before it discloses PHI to that subcontractor. The business associate can show the covered entity the list and the dates on request.

Red flags

A subcontractor started before its agreement was signed. Click-through terms that carry none of the content. An intra-group arrangement that is a policy and not an agreement; counsel confirms whether it is enough.

If it is missing

Ask for the term and for the list of subcontractors that reach ePHI, with the date of each agreement. Compare the dates with the dates each began to handle ePHI.

Asked for by

164.308(a)(1)(ii)(A); 164.306(a)

The agreement says where ePHI is stored and processed, and who may reach it, so the covered entity's risk analysis can include it. This is a security term rather than a term the Rule requires by name.

Usually drafted from: CL-05 Locations of service and data; CL-09 Access control and multi-factor authentication for supplier staff

Look for

Where ePHI is stored and processed (countries, regions, facilities, cloud regions) and who may reach it (support staff, administrators, affiliates, subcontractors), with notice of a change. This is a security term. The Rules do not ask for it by name. It is here because the covered entity's risk analysis has to include all the ePHI it holds wherever it is, including where suppliers hold or reach it.

Red flags

"Global infrastructure" with no regions. Support from anywhere with no list. A subcontractor list that is not kept.

If it is missing

Ask for it. If the supplier will not name locations, record that in the risk analysis (A04) as an unknown, and rate the unknown.

BC-01

A security standard to be met and evidence of it

Without a named standard the safeguards promised in BT-02 cannot be tested, and a gap found later is a request and not a breach.

A schedule that names the standard and the evidence the supplier gives: an independent assurance report with its scope, a questionnaire answer. The scope covers the service and the site you use.

CL-01 Security requirements and standards; CL-02 Certification and independent assurance

BC-02

A right to audit or to receive assurance reports

A right to look is how you check what BT-02 and BT-03 promise.

A right to audit on notice, a shorter notice after an incident, and a fallback to an independent assurance report where the supplier will not open its sites. Reports are shared under a non-disclosure agreement and not replaced by a summary.

CL-03 Right to audit and access; CL-18 Service levels and security reporting

BC-03

Notice of a security incident in a shorter time than the Rule's outer limit, and how it is sent

BT-04 and BT-06 leave the time to the contract. A shorter time than the outer limit gives the covered entity room to do its own assessment and notices.

A time written in the agreement, a defined start, a named channel that is monitored all day, and a follow-up update duty. The time itself is the contract's and is not stated here.

CL-07 Security incident notification

BC-04

Cooperation in the covered entity's incident response and its notices

After an incident the covered entity needs logs, people and decisions from the supplier at once.

Named contacts on both sides, evidence preserved, access to logs and staff, and agreement on who speaks to individuals and the press.

CL-11 Cooperation in our incident response

BC-05

Notice of changes to subcontractors and of material changes in the service

BT-03 keeps subcontractors under the same terms, but the covered entity cannot assess a subcontractor it does not know about.

A current list, notice before a change, and a right to object. Notice of material change in the service itself.

CL-04 Sub-processors and subcontracting; CL-20 Notice of material changes

BC-06

Access controls and multi-factor authentication for the business associate's staff

Stolen or shared credentials of supplier staff are a common route to ePHI (TH-03 in the risk analysis threats).

Unique accounts, multi-factor sign-in for staff with access to ePHI, access limited by role, and removal on leaving.

CL-09 Access control and multi-factor authentication for supplier staff

BC-07

Business continuity and recovery commitments

Your own contingency planning (HR-26) depends on what the supplier can restore and how fast. The supplier's plan is part of what you rely on.

Recovery objectives written in the agreement, a tested plan, and evidence of the last test. Compare with your own (P22, P23).

CL-10 Business continuity and disaster recovery

BC-08

Exit and transition assistance, including a return format and date

Leaving a supplier safely needs time, help and a format. Without them BT-11 is a promise that cannot be used.

A transition period, help with migration, a return format, a date, and a statement of what the supplier may charge.

CL-14 Exit and transition assistance

Present

The agreement asks for it in words a reader can find, and nothing elsewhere in the agreement takes it back.

Partly present

Some of it is there. Say which part is missing, as the red flags describe.

Missing

Nothing in the agreement, its schedules or the contract it sits in asks for it.

Not applicable

The term is conditional and its condition does not arise. Write the reason in the note.

Counsel's term

Mark this beside a Privacy Rule term when you have found it present or missing. Counsel reads the wording and decides.

Agreement and date

[[title, reference, date]]

Party and legal entity

[[legal name]]

Our relationship to it

[[Our business associate / Our subcontractor / Our customer (we are its business associate or subcontractor)]]

Service and vendor owner

[[what it does for us; owner]]

ePHI it will reach, and where

[[categories, systems, locations]]

Role confirmed by

[[counsel, date]]

Documents read

[[agreement; security schedule; service contract; web terms incorporated; order of precedence]]

Checked by, and on

[[security official or delegate, YYYY-MM-DD]]

BT-01 Compliance with the Security Rule

BT-02 Appropriate safeguards

BT-03 Subcontractors agree to the same

BT-04 Report security incidents

BT-05 Report impermissible uses and disclosures

BT-06 Breach notice content

BT-07 Permitted and required uses and disclosures

Counsel's term

BT-08 Access, amendment and accounting support

Counsel's term

BT-09 Carrying out the covered entity's obligations

BT-10 Books and records open to the Secretary

BT-11 Return or destruction at the end

BT-12 Termination for violation

BT-13 Cure or end for a known pattern

BT-14 Management and administration of the business associate

Counsel's term

BT-15 Subcontractor agreements are written before PHI moves

BT-16 Locations and ePHI handling

Common additions wanted, and the result of each (BC-01 to BC-08)

[[for each: wanted or not, where found, Present / Partly present / Missing, and the action]]

Flow-down check done (section 9)

[[Yes / No: date and who]]

Counts of results, terms BT-01 to BT-16

[[for example: n Present, n Partly present, n Missing, n Not applicable]]

Terms to refer to counsel

[[which, and the date they were sent]]

Outcome

[[Approved for signature / Approved for signature once the missing terms are added / Not approved: no ePHI is shared]]

Approved by (HD-04): counsel and the executive who signs contracts

[[names, dates]]

Security terms reviewed by (HD-04)

[[security official, date]]

Entered on the register (EV-16)

[[date, by]]

Next review

[[12]] months from the date above, or sooner on a trigger. The interval is the pack's default, not the Rule's.

Cloud hosting provider (EXAMPLE)

Subcontractor

14 June 2024

12 Present, 2 Missing, 2 Not applicable. The incident clause names breaches but not other security incidents, and sets no time.

Customer-support ticketing tool (EXAMPLE)

Subcontractor

Not signed

No agreement. All sixteen terms are Missing. No agreement yet. ER-07.

Riverside Family Clinic (EXAMPLE)

Customer (covered entity)

10 February 2025

Nothing missing. On the clinic's paper; checked against A05, nothing missing.

BT-04 Report security incidents

Section 4 (EXAMPLE)

Missing

Clause names breaches but not other security incidents, and names no monitored contact (EXAMPLE).

BT-06 Breach notice content

Section 6 (EXAMPLE)

Missing

No time is set for the notice (EXAMPLE).

BT-07 Permitted and required uses and disclosures

Counsel's term

Section 7 (EXAMPLE)

Present

Referred to counsel (EXAMPLE).

BT-08 Access, amendment and accounting support

Counsel's term

Section 8 (EXAMPLE)

Present

Referred to counsel (EXAMPLE).

BT-09 Carrying out the covered entity's obligations

None

Not applicable

The service carries out no obligation of the clinics. Re-check when a service is added (EXAMPLE).

BT-14 Management and administration of the business associate

Counsel's term

None

Not applicable

The agreement gives the provider no management and administration permission (EXAMPLE).

Party and legal entity

Who the agreement is with, by legal name.

Direction

Our business associate, our subcontractor, or our customer (a covered entity or business associate whose paper we hold).

Service and owner

What it does for us, and the vendor owner.

ePHI reached

The categories, the volume in words, and the systems (from the ePHI inventory, A04).

Locations and subcontractors

Where ePHI is held and processed (BT-16) and the supplier's subcontractors that reach it (BT-03).

Agreement

Reference, date signed, and the date ePHI first flowed. The second must not be earlier than the first.

Terms checked

Date of the review form, who checked, and the terms Missing.

Amendment status

Asked for, agreed, signed, or refused (with the decision under HD-04 or HD-03).

Tier and last assessment

From P06-A03.

Next review

[[12]] months from the last (the pack's default, not the Rule's), or sooner on a trigger: a new service, a changed location, a new subcontractor, an incident.

Exit

Ended on, return and destruction confirmed on, and the date the file may be released (six years).

Cloud hosting provider (EXAMPLE)

Subcontractor

Hosts the service. Owner: [[vendor owner]]. All the clinics' appointment and messaging data. Region: EXAMPLE.

Signed 14 June 2024. ePHI first flowed: [[date, no earlier than signature]]

30 September 2026, security official. Missing: BT-04, BT-06

Asked for. Counsel drafting.

[[12]] months, or on a trigger

Customer-support ticketing tool (EXAMPLE)

Subcontractor

Support tickets. Owner: [[vendor owner]]. Patient details in ticket text.

Not signed

30 September 2026. All sixteen Missing

Not started. Patient details are kept out of tickets until signature.

On signature

Riverside Family Clinic (EXAMPLE)

Customer (covered entity)

Customer. Its paper. Owner: [[customer owner]].

Signed 10 February 2025

Checked as business associate. None missing

None needed

[[12]] months, or on a trigger

FD-1 Which subcontractors create, receive, maintain or transmit ePHI for you in this service?

A list with the legal name, the service, the ePHI categories and the locations (BT-16).

No list: record it as Missing under BT-03 and BT-15, and ask again.

FD-2 Does each hold a signed written agreement with you with the same content?

The date signed and the date it began to handle ePHI. Ask to see the security terms, not the whole contract, if they are confidential.

An agreement dated after ePHI began to flow, or none: record it, tell counsel, and ask the business associate for its plan to correct it.

FD-3 Does each agreement bind the subcontractor to the Security Rule and to report security incidents to you?

The clause references (BT-01, BT-04).

A subcontractor that does not report to the business associate leaves the business associate unable to report to you.

FD-4 How soon will a subcontractor's incident reach you?

The business associate's time to you must allow for its own subcontractors' time to it. Read the two together.

Where the subcontractor is the business associate's agent, its discovery counts as the business associate's (164.410(a)(2)), so a chain whose times add to more than the outer limit in P09 RD-20 cannot be relied on. Counsel confirms whether it is an agent. Ask for shorter times lower down.

FD-5 How are you told when a subcontractor is added, replaced or removed?

A notice duty (BC-05) and the register entry that results.

No notice: add BC-05, or ask for the list on a schedule you set.

FD-6 What happens to ePHI at a subcontractor when the service ends?

Return or destruction passes down (BT-11) and you receive confirmation covering the subcontractor.

Copies at a subcontractor outlive the service. Ask for confirmation to cover them.

1. Find out what exactly is refused

Ask for the reason in writing. Is it the wording, the principle or the cost? Many refusals are of a particular sentence and not of the term.

2. Ask counsel whether the term is one the Rules ask for

Terms BT-01 to BT-12 and BT-15 are each asked for by a paragraph of the Security Rule, the Privacy Rule or the Breach Notification Rule (BT-09 only where the business associate carries out an obligation of the covered entity). BT-13 and BT-14 rest on paragraphs of 164.504(e) that set a duty of the covered entity or a permission, not required wording, and are good practice. BT-16 and BC-01 to BC-08 are not asked for by name. The answer decides what you can trade.

3. Offer the fallback that keeps the purpose

Examples: accept the supplier's own standard in place of yours where its scope covers the service you use; accept a standing summary for unsuccessful attempts; accept a defined channel in place of a named person. The P06-A07 negotiation notes give fallbacks for each clause.

4. Accept the counterparty's paper only after checking it

When a large supplier will only sign its own agreement, run the review form against that paper. Record what is missing and what you asked for.

5. For a term the Rules ask for, do not share ePHI until it is in place

HR-15 does not allow ePHI to go to a business associate before a written agreement has the content the Security Rule asks for. The choices are an amended agreement, a different supplier, or not sending ePHI to that supplier. Counsel decides the Privacy Rule terms.

6. For a common addition, decide and record

A missing BC term is a risk decision and not a legal stop. The person the P05 band of the residual risk names decides; an accepted risk is recorded under P05 RM-08. Add it to the risk analysis (A04).

7. Tell the executive sponsor

A refusal that blocks a service is a business decision as well. The vendor owner and the executive who signs contracts decide whether to change supplier, with the security official's advice and counsel's.

Confirm the role and the need

Use section 2. Counsel confirms where it is not clear.

Vendor owner, with counsel

Assess the supplier

Tier and assess it as P06-A03 sets. Do not wait for the agreement to be negotiated.

Vendor owner, security official

Add it to the register

Create the entry before signature, with the data it will reach and where (EV-16).

Vendor owner

Run the review form

Check BT-01 to BT-16 and the common additions you wanted. Record the result.

Security official

Counsel reads the Privacy Rule terms and the whole

BT-07, BT-08 and BT-14 are counsel's. Counsel also reads the order of precedence between the agreement and the service contract.

Legal counsel

Approve (HD-04)

Counsel and the executive who signs contracts approve it, and the security official has reviewed the security terms. Record the date and outcome.

As HD-04 sets

Keep the signed copy and the completed form

These are EV-17. The register entry now shows the agreement date and the terms checked.

Vendor owner

Only then share ePHI

Set up access (P07, P13, P14) after the date of signature. A test with live patient data before signature runs against HR-15.

IT lead, ePHI system owner

Give notice and set the date

Use the termination terms (BT-12) and the exit terms (BC-08). Agree the end date, the return format and the last day of access.

Vendor owner, counsel

Take your data back

Ask for the return, in the format agreed (BT-11). Check that it opens and that it is complete before anything is deleted.

IT lead, ePHI system owner

End the access

Remove accounts, keys, tokens and network paths on the last day (P13, P14). Record the time.

IT lead

Ask for destruction, and for the supplier's subcontractors to destroy too

The method follows the HHS guidance for secured PHI (BT-11). Ask for the supplier's written confirmation, including subcontractor copies and backups.

Vendor owner

If return or destruction is not feasible

The protections continue and use is limited to the reasons it is not feasible (BT-11). Record what is held, where, why and for how long, and diarise a re-check.

Security official, counsel

Update the register and keep the file

Mark the entry Ended, with the date, and keep the agreement, the completed form and the confirmation for six years from the later of the date created and the date last in effect (HR-13).

Vendor owner

Update the risk analysis

The supplier is removed from the inventory of places ePHI is held (A04).

Security official

When does the business associate's duty to tell the covered entity of a breach start, and what is its outer limit?

A business associate that discovers a breach of unsecured PHI tells the covered entity, identifies each individual affected, and gives the information the covered entity needs for its own notice. The contract may set a shorter time than the Rule; the contract's time is a P06 clause (P06-A07 CL-07). The outer limit is the row RD-20 in the incident plan pack's reporting duties (P09-A03 Incident Response Plan). The business associate's discovery is the first day a breach is known to it or, by exercising reasonable diligence, would have been known to it (164.410(a)(2)). The covered entity's own discovery is recorded as P09 IM-13 sets.

What time does the agreement set?

The time is a contract choice, shorter than the outer limit, and is a placeholder in the supplier clause library (P06-A07 CL-07). The adopter decides it with counsel. The time you write is the one in your agreement and not one copied from this document.

What must the notice contain?

BT-06: the identity of each affected individual where it can be given, and the other available information the covered entity needs for its own notice, supplied promptly as it becomes available (164.410(c)).

What does the covered entity do with the notice?

It opens a case under the incident plan (P09-A03 Incident Response Plan) and works through the breach assessment (Breach Assessment & Notification Decision Procedure). The reporting duties of a covered entity are RD-17 to RD-19. The timeline matrix and the notice templates are P18-A09 US Incident Notification Timeline Matrix (HIPAA, SEC, NYDFS and State Law) and P18-A10 US Notification Templates (HIPAA, SEC Form 8-K, NYDFS, State Attorney General).

Who decides that an event is a breach to be reported?

HD-06: as the incident plan sets for reporting to an authority. The assessment feeds the decision and never replaces it.

Security official

Reviews the security terms with the form (HD-04), keeps the results, raises gaps on the tracker, and decides what the risk analysis says about a supplier.

Executive sponsor

Signs the contract or names who does, approves the agreement with counsel (HD-04), and decides whether to change supplier when a term is refused.

Vendor owner

Owns the supplier relationship and the register entry (EV-16), requests amendments, and runs onboarding and offboarding.

Legal counsel

Confirms the role, reads the Privacy Rule terms and the whole agreement, and approves with the executive who signs (HD-04).

Privacy lead

Is told of a breach notice from a business associate and decides, with the security official, what the covered entity does next (HD-06; A06).

IT lead

Sets up and removes access, takes the data back and checks it, and confirms destruction on systems it runs.

ePHI system owner

Knows what ePHI is in the service and signs off the return and destruction.

HD-04 Approve a business associate agreement

Legal counsel and the executive who signs contracts; the security official reviews the security terms (A05)

A contract is never signed with a business associate that has not been through the supplier steps in P06.

EV-16

A register of business associates and subcontractors that can reach ePHI

The register of section 8: every party that can reach ePHI, the agreement, the locations, the terms checked, and the review dates.

Vendor owner

OR-03 (HIPAA Security Rule Readiness Self-Assessment)

EV-17

Each business associate agreement, signed, with its security terms checked (A05)

The signed agreement and each amendment, the completed review form (section 6), the counsel's note on the Privacy Rule terms, the flow-down answers, and for an ended agreement the return and destruction confirmation.

Vendor owner

OR-01 (HIPAA Security Rule Readiness Self-Assessment)

PF-2 Counting a signed agreement as the reason an organisation is a business associate, or its absence as the reason it is not.

Decide the role from what the organisation does with PHI (section 2). Record the answer and have counsel confirm it.

PF-7 Sharing patient information with a supplier before the agreement is signed.

Do not share ePHI until the agreement is signed and its security terms are checked. Set up access after the date of signature (section 11).

Reading the agreement's heading and not the schedules. The security terms often sit in an order of precedence below the service contract's own limits.

Read the whole paper, the schedules and any web terms they incorporate. Record which document wins if they disagree.

Taking a supplier's security whitepaper as the agreement.

A statement is not a promise. Ask for the promise to be written into the agreement or attached with a duty to keep it true (BT-02).

Covered entity

A health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a standard transaction.

Business associate

A person who handles PHI for a covered entity (or for another business associate) in the way 160.103 describes, or provides listed services that involve disclosure of PHI to it. A subcontractor of a business associate that handles PHI for it is a business associate too.

Electronic protected health information (ePHI)

PHI that is transmitted by electronic media or maintained in electronic media. It is what the Security Rule protects.

Security incident

An attempted or successful unauthorized access, use, disclosure, modification or destruction of information, or interference with system operations (164.304). Most security incidents are not breaches.

Breach

An acquisition, access, use or disclosure of PHI not permitted under the Privacy Rule that compromises its security or privacy (164.402), subject to three exclusions and the presumption the definition sets.

Subcontractor

A person to whom a business associate delegates a function, activity or service in which the person creates, receives, maintains or transmits PHI on behalf of the business associate. It is a business associate too.

Business associate agreement

The written contract or other arrangement through which the covered entity (or a business associate) obtains the assurances 164.308(b) and 164.314(a) ask for. HHS uses the short form BAA.

Flow-down

The duty that the same terms pass from one link of the chain to the next.

Register

The list of every business associate and subcontractor that can reach ePHI (EV-16), with the facts of each agreement.

Pack default

An interval or practice that this pack sets and that the Rules do not. It is shown in double brackets and is yours to change.

HIPAA Applicability Assessment

Decides the role (covered entity, business associate or subcontractor) that sets which side of this document applies

Security Rule Safeguard Register

The standards for business associate contracts (164.308(b) and 164.314(a)) in the register of safeguards

Security Risk Analysis Method

The risk analysis that has to include the ePHI held at suppliers, which BT-16 feeds

Breach Assessment & Notification Decision Procedure

Decides whether an incident that a business associate reports is a breach

HIPAA Documentation & Evidence Checklist

Lists EV-16 and EV-17 with the other records to keep

HIPAA Gap & Remediation Tracker

Takes the gaps this form finds

HIPAA Security Rule Readiness Self-Assessment

The readiness items OR-01 to OR-03 are about agreements, their checks and the register

P06-A07 Supplier Contract Security Clause Library

The clause library. The business associate terms point to its clauses by ID.

P06-A03 Supplier Security Assessment Procedure

How a supplier is assessed and reassessed.

P05-A08 Risk Acceptance Form & Approval Record

The record of an accepted risk and its review date.

P09-A03 Incident Response Plan

The incident response plan, its roles and its decision rights. P31 changes none of them.

P18-A09 US Incident Notification Timeline Matrix (HIPAA, SEC, NYDFS and State Law)

The US notification timeline matrix: the clocks, by regime.

P18-A10 US Notification Templates (HIPAA, SEC Form 8-K, NYDFS, State Attorney General)

The US notification templates: the notices to individuals, the media, HHS and the covered entity.

[[Your supplier security policy; your contract approval procedure; your template agreement and your counsel's checklist]]

[[Parent policy; who signs; what counsel already requires]]

ISO/IEC 27001:2022

Annex A 5.20 — Addressing information security within supplier agreements

The agreement terms that address supplier security: the form lists them and the form's result is kept with the agreement

NIST CSF 2.0

GV.SC-05 — “Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties”

Security requirements for suppliers are written into the agreements: the sixteen terms and the common additions are those requirements for a business associate

HIPAA — 45 CFR Parts 160 and 164

§ 160.103, “Business associate” — a person who, “on behalf of” a covered entity and “other than in the capacity of a member of the workforce”, “creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter”, or who provides listed services (legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial) where the service involves disclosure of protected health information to the person. A covered entity may be a business associate of another covered entity. The definition includes data transmission services with routine access, a personal health record offered on behalf of a covered entity, and “A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate”. Four exceptions are listed: disclosures to a provider for treatment, a plan sponsor, a government agency determining eligibility, and a covered entity in an organized health care arrangement

Section 2 and the chain: who is a business associate, the four exceptions, and subcontractors

HIPAA — 45 CFR Parts 160 and 164

§ 164.308(b) — a covered entity may permit a business associate to create, receive, maintain or transmit electronic protected health information on its behalf “only if” it obtains assurances, in accordance with § 164.314(a), that the business associate will appropriately safeguard the information; a covered entity is not required to obtain them from a business associate that is a subcontractor. A business associate must obtain the same assurances from its subcontractor. The assurances are documented through a written contract or other arrangement (required)

The chain, onboarding and the register: assurances before ePHI goes, documented in writing

HIPAA — 45 CFR Parts 160 and 164

§ 164.314(a) — the contract between a covered entity and a business associate, or between a business associate and a subcontractor, must provide that the business associate will comply with the applicable requirements of the Security Rule, will ensure that any subcontractor that handles electronic protected health information agrees to comply by contract, and will report to the covered entity “any security incident of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410”

BT-01, BT-03, BT-04, BT-15: the security content of the contract

HIPAA — 45 CFR Parts 160 and 164

§ 164.502(e) and § 164.504(e) — the Privacy Rule requires a written contract or other written arrangement with a business associate that establishes the permitted and required uses and disclosures. In outline it permitted and required uses and disclosures and provides that the business associate will, among other things, “Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information”, report uses and disclosures not provided for by the contract including breaches of unsecured protected health information, bind its subcontractors, make its books and records available to the Secretary, and return or destroy the information at termination if feasible. The contract must authorize termination if the covered entity determines a material term was violated. A covered entity or business associate that knows of a pattern of activity constituting a material breach must take reasonable steps to cure it or end the arrangement

BT-02, BT-05, BT-07 to BT-14: the Privacy Rule content, with counsel's terms marked

HIPAA — 45 CFR Parts 160 and 164

§§ 164.404 to 164.412 — after “discovery of a breach of unsecured protected health information” a covered entity notifies the individuals affected (§ 164.404), prominent media outlets where the threshold is passed (§ 164.406) and the Secretary of Health and Human Services (§ 164.408); a business associate notifies the covered entity and identifies each individual affected (§ 164.410); a law enforcement official’s statement can delay a notice (§ 164.412). Each section sets its own time limit and content. This pack does not restate them: P09 RD-17 to RD-20 and P18-A09 and P18-A10 hold them

BT-04 to BT-06 and the incident section: the business associate's notice and its start. The clocks are P09's and P18's

HITECH Act, as codified in 42 U.S.C.

42 U.S.C. 17931 (HITECH Act section 13401) — “Sections 164.308, 164.310, 164.312, and 164.316 of title 45, Code of Federal Regulations, shall apply to a business associate of a covered entity in the same manner that such sections apply to the covered entity”, and the additional security requirements of the HITECH title are incorporated into the business associate agreement

The chain: the Security Rule sections that apply to a business associate directly

HITECH Act, as codified in 42 U.S.C.

42 U.S.C. 17934 (HITECH Act section 13404) — a business associate that obtains or creates protected health information under a written contract “may use and disclose such protected health information only if such use or disclosure, respectively, is in compliance with each applicable requirement of section 164.504(e)”

BT-07: a business associate that holds PHI under a written contract may use and disclose it only in compliance with each applicable requirement of 164.504(e)

HHS Office for Civil Rights guidance

“Business Associates” (content last reviewed 30 July 2026): a business associate is “directly liable” for complying with certain provisions of the HIPAA Rules, and a subcontractor that creates, receives, maintains or transmits protected health information on behalf of a business associate is also a business associate. The page lists examples, among them a cloud service provider engaged to create, receive, maintain or transmit electronic protected health information, an IT contractor with access to it, and a third party administrator; and lists situations in which no business associate agreement is required (treatment disclosures to a provider, a person whose access is only incidental, a conduit that only transmits). A business associate must have a business associate agreement with its subcontractor before disclosing protected health information to it

Section 2: examples of business associates, the cases with no agreement, and the subcontractor duty

HHS Office for Civil Rights guidance

Preamble to the Omnibus Rule, 78 FR 5566 (25 January 2013), on who is a business associate (the passage at 78 FR 5571 to 5572 was read): “The conduit exception is a narrow one”, “intended to exclude only those entities providing mere courier services”, and a conduit “does not access it other than on a random or infrequent basis as necessary to perform the transportation service or as required by other law”. The exception “is limited to transmission services (whether digital or hard copy), including any temporary storage of transmitted data incident to such transmission”; “an entity that maintains protected health information on behalf of a covered entity is a business associate and not a conduit, even if the entity does not actually view the protected health information”. The preamble is interpretation, not the text of the Rule. The rest of the preamble was not read

Section 2: the narrow conduit exception, and why an entity that maintains protected health information is never a conduit