ThomasMoreAI HIPAA Business Associate Agreement Management — §164.502(e), §164.504(e)
Overview
The HIPAA Privacy and Security Rules require covered entities to obtain satisfactory assurances from business associates that they will appropriately safeguard PHI. These assurances are documented through Business Associate Agreements (BAAs). The HITECH Act of 2009 and the 2013 Omnibus Rule fundamentally changed the BA landscape by making business associates directly liable for HIPAA Security Rule compliance and certain Privacy Rule provisions, and by extending the BAA chain to subcontractors. A BAA is not merely a contractual formality — it is a regulatory requirement, and failure to execute a BAA when required is itself a HIPAA violation subject to enforcement.
Who Is a Business Associate — §160.103
Definition
A business associate is a person or entity that:
- On behalf of a covered entity or another business associate, creates, receives, maintains, or transmits PHI for a function or activity regulated by the HIPAA Administrative Simplification rules, including claims processing, data analysis, utilization review, quality assurance, billing, benefit management, practice management, and repricing; OR
- Provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services to or for a covered entity where the provision of the service involves the disclosure of PHI
Who Is NOT a Business Associate
| Entity | Why Not a BA | Reference |
|---|---|---|
| Member of the covered entity's workforce | Employees, volunteers, trainees under direct control are workforce, not BAs | §160.103 definition of workforce |
| Another covered entity exchanging PHI for treatment | Treatment disclosures between covered entities do not create BA relationship | §164.502(e)(1)(i) |
| Health plan sponsor receiving only summary health information or enrollment/disenrollment information | Exemption for plan sponsor limited functions | §164.504(f) |
| Conduit (entity that merely transports PHI without accessing it beyond what is necessary for transport) | Postal service, Internet service providers, couriers with transient access | OCR guidance on conduit exception |
| Banking institutions processing financial transactions containing only the minimum necessary demographic information | Payment processing exception | OCR FAQ on financial institutions |
| Person or entity whose functions do not involve the use or disclosure of PHI | Janitorial services, plumbing, electrical contractors | §160.103 |
Common Business Associate Categories at Asclepius Health Network
| BA Category | Examples | PHI Access Level |
|---|---|---|
| EHR/IT Vendors | Epic hosting, cloud infrastructure (Azure) | Full ePHI access — storage, maintenance, support |
| Revenue Cycle Management | Third-party billing company, collections agency | Demographics, insurance, diagnosis/procedure codes, dates of service |
| Transcription Services | Medical transcription vendor | Dictated clinical notes, patient identifiers |
| Legal/Accounting | Healthcare law firm, external auditors | PHI involved in litigation, audit samples |
| Data Analytics | Population health analytics vendor | De-identified or limited datasets; full PHI if performing analytics on behalf of CE |
| Health Information Exchange | Regional HIE operator | ADT, CCD documents, lab results |
| Shredding/Destruction | Document destruction vendor | Paper records containing PHI during destruction |
| Accreditation | Joint Commission surveyors | PHI in medical records reviewed during survey |
| Consulting | Privacy/security consultants, compliance firms | PHI accessed during assessments |
| Cloud Services | Email hosting, cloud storage, SaaS platforms | ePHI stored or processed in cloud environment |
Required BAA Provisions — §164.504(e)(2)
Mandatory Contract Terms
A BAA must include the following provisions:
1. Permitted and Required Uses and Disclosures
The BAA must establish the permitted and required uses and disclosures of PHI by the business associate. The BA may not use or disclose PHI other than as permitted or required by the BAA or as required by law.
Asclepius Health Network BAA language: "Business Associate shall not use or disclose Protected Health Information other than as permitted or required by this Agreement, as Required by Law, or as otherwise permitted by 45 CFR §164.504(e)."
2. Prohibition on Unauthorized Use or Disclosure
The BAA must not authorize the BA to use or disclose PHI in a manner that would violate the Privacy Rule if done by the covered entity.
Exception: The BAA may permit the BA to use PHI for:
- Proper management and administration of the BA
- Carrying out its legal responsibilities
- Data aggregation services (if specifically authorized)
3. Appropriate Safeguards
The BA must use appropriate safeguards and comply with the Security Rule to prevent unauthorized use or disclosure.
Asclepius Health Network BAA language: "Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI that it creates, receives, maintains, or transmits on behalf of Covered Entity, in accordance with 45 CFR Part 164, Subpart C."
4. Breach Reporting
The BA must report to the covered entity any use or disclosure of PHI not provided for by the BAA, including breaches of unsecured PHI as required by §164.410.
Asclepius Health Network BAA language: "Business Associate shall report to Covered Entity any use or disclosure of Protected Health Information not provided for by this Agreement of which Business Associate becomes aware, including any Breach of Unsecured Protected Health Information as required by 45 CFR §164.410, without unreasonable delay and in no case later than five (5) business days after discovery of the Breach."
5. Subcontractor Requirements
The BA must ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the BA agree to the same restrictions and conditions that apply to the BA, including entering into a BAA with the subcontractor.
6. Access Rights
The BA must make PHI available to the covered entity (or directly to the individual if designated in the BAA) to satisfy the individual's right of access under §164.524.
Asclepius Health Network BAA language: "Business Associate shall make available Protected Health Information in a Designated Record Set to Covered Entity, or at Covered Entity's direction, directly to the Individual, within fifteen (15) business days of a request, to satisfy Covered Entity's obligations under 45 CFR §164.524."
7. Amendment Rights
The BA must make PHI available for amendment and incorporate amendments as directed by the covered entity under §164.526.
8. Accounting of Disclosures
The BA must make available the information required to provide an accounting of disclosures under §164.528.
9. HHS Access
The BA must make its internal practices, books, and records relating to the use and disclosure of PHI available to HHS for determining compliance.
10. Return or Destruction of PHI
At termination of the BAA, the BA must return or destroy all PHI received from or created on behalf of the covered entity. If return or destruction is not feasible, the BA must extend the protections of the BAA for as long as it maintains the PHI.
Asclepius Health Network BAA Lifecycle Management
| Phase | Activities | Responsible Party | Timeline |
|---|---|---|---|
| Identification | Determine if vendor relationship requires BAA through PHI access assessment questionnaire | Privacy Office + Procurement | Before contract execution |
| Risk Assessment | Evaluate vendor security posture through questionnaire, SOC 2 review, security assessment | Information Security | 15-30 business days |
| Negotiation | Execute BAA using Asclepius standard template; negotiate deviations with legal review | Legal + Privacy Office | Concurrent with master services agreement |
| Execution | Final BAA signed by authorized signatories; logged in BAA tracking system | Legal + Compliance | Before PHI access begins |
| Monitoring | Annual security assessment questionnaire; SOC 2 report review; incident tracking | Information Security + Privacy | Annually and upon trigger events |
| Renewal/Amendment | Review BAA at master agreement renewal; update for regulatory changes | Legal + Privacy Office | At MSA renewal or regulatory change |
| Termination | PHI return/destruction verification; certificate of destruction obtained; BAA tracking system updated | Privacy Office + IT | Within 60 days of termination |
Business Associate vs Subcontractor Obligations
Direct Liability Under HITECH/Omnibus Rule
Since the 2013 Omnibus Rule, business associates are directly liable for:
| Obligation | BA Directly Liable | Subcontractor Directly Liable |
|---|---|---|
| Security Rule compliance (all standards) | Yes — §164.306, 308, 310, 312, 314, 316 | Yes — through BA-subcontractor BAA |
| Impermissible uses/disclosures under Privacy Rule | Yes — §164.502(a)(3) | Yes — through BA-subcontractor BAA |
| Breach notification to covered entity | Yes — §164.410 | Yes — notify BA, who notifies CE |
| Minimum necessary standard | Yes — §164.502(b) | Yes — through BAA chain |
| Individual rights (access, amendment, accounting) | Yes — as delegated | Yes — as delegated in BAA chain |
| Civil and criminal penalties | Yes — directly enforceable by OCR | Yes — directly enforceable by OCR |
Subcontractor BAA Chain
Covered Entity
└── BAA → Business Associate
└── BAA → Subcontractor (Level 1)
└── BAA → Subcontractor (Level 2)
└── ...continues downstream
Each link in the chain must have a BAA in place. Asclepius Health Network requires primary BAs to:
- Maintain a registry of subcontractors with PHI access
- Provide the registry to Asclepius upon request
- Ensure subcontractor BAAs contain provisions no less restrictive than the primary BAA
- Report subcontractor breaches through the primary BA
Breach Chain Notification Flow
When a breach occurs at a subcontractor:
- Subcontractor discovers breach → notifies BA within timeframe specified in sub-BA (Asclepius standard: 24 hours)
- Business Associate validates and documents → notifies Covered Entity within BAA timeframe (Asclepius standard: 5 business days of BA's discovery)
- Covered Entity conducts four-factor risk assessment → determines if breach notification to individuals/HHS/media/AG is required
- Covered Entity fulfills notification obligations (or delegates to BA per BAA)
Termination Remedies — §164.504(e)(2)(iii)
Material Breach
If the covered entity knows of a pattern of activity or practice of the BA that constitutes a material breach or violation of the BAA:
- Cure: Provide the BA an opportunity to cure the breach or end the violation
- Terminate: If cure is not successful, terminate the contract if feasible
- Report to HHS: If termination is not feasible, report the problem to HHS OCR
Asclepius Health Network Termination Process:
- Written notice of material breach with 30-day cure period
- If not cured within 30 days, termination notice with 60-day wind-down period
- During wind-down: PHI access restricted to minimum necessary for transition
- At termination: BA must return or certify destruction of all PHI within 30 days post-termination
- If return/destruction infeasible, BA must provide written certification of ongoing protection
PHI Return/Destruction Verification
Asclepius Health Network requires:
- Written certification of PHI destruction from BA within 30 days of termination
- Destruction must comply with NIST SP 800-88 Rev. 1 for electronic media
- Paper records destroyed via cross-cut shredding or incineration
- Asclepius reserves the right to audit destruction compliance
Common BAA Deficiencies
| Deficiency | Risk | Mitigation |
|---|---|---|
| No BAA in place for qualifying vendor relationship | Direct HIPAA violation; CE liable for BA's actions without contractual protections | Pre-procurement PHI assessment; no PHI access before BAA execution |
| BAA does not include breach notification provisions | CE may not learn of breach timely; notification deadlines missed | Use standard template with mandatory breach reporting within 5 days |
| BAA permits BA to use PHI for BA's own purposes (marketing, analytics) | Impermissible use of PHI; potential sale of PHI violation | Restrict BA use to services performed for CE; prohibit independent use |
| No subcontractor flow-down requirements | Downstream entities handle PHI without HIPAA obligations | Require BA to bind subcontractors to equivalent BAA terms |
| No termination provisions for PHI return/destruction | PHI retained indefinitely by former BA without safeguards | Mandatory return/destruction clause with certification requirement |
| Outdated BAA not updated for Omnibus Rule | Missing required provisions (subcontractor, breach notification, direct liability acknowledgment) | Periodic BAA review aligned with MSA renewal |
Enforcement Actions
- North Memorial Health Care (2016): $1.55 million — failed to execute a BAA with a major contractor that had access to ePHI of 289,904 individuals; failed to conduct organization-wide risk analysis
- Care New England Health System (2019): $400,000 — failed to execute BAA with BA that experienced a breach; BAA was under negotiation but not signed when PHI was disclosed
- UMMC (University of Mississippi Medical Center) (2016): $2.75 million — multiple Security Rule violations including failure to manage BA relationships properly
Integration Points
- hipaa-privacy-rule: BAA requirement stems from Privacy Rule §164.502(e); BA permitted uses mirror Privacy Rule provisions
- hipaa-security-rule: BA must independently comply with Security Rule; BAA must require appropriate safeguards
- hipaa-breach-notify: BAA breach notification chain is critical path for timely CE notification and individual notice
- hipaa-minimum-necessary: BA disclosures must comply with minimum necessary standard