Checklist · Healthcare · HIPAA

Checklist: HIPAA Business Associate Due Diligence Before Signature

A business associate agreement records a promise. Diligence tests whether the vendor can keep it, before protected health information starts to flow.

By Lincoln Square Law · 8-minute read

🖨 Print this checklist

A business associate agreement is necessary, but it is not diligence. The agreement records what a vendor promises. Diligence is how a covered entity decides whether the vendor can keep those promises before protected health information starts to flow. HIPAA permits a covered entity to disclose protected health information to a business associate only if it obtains satisfactory assurances that the business associate will appropriately safeguard it (45 C.F.R. 164.502(e)). This checklist organizes the work that should happen before signature, in the order it is usually done.

Confirm the relationship

• Decide whether the vendor is a business associate. A business associate creates, receives, maintains, or transmits protected health information on behalf of a covered entity, or provides certain services that involve it (45 C.F.R. 160.103). Cloud storage providers, billing companies, IT support, transcription services, and many software vendors qualify. A vendor that merely provides a conduit for transmission may not.
• Map the data. Identify what protected health information the vendor will receive, from which systems, in what volume, and for what purpose.
• Apply the minimum necessary standard. Limit what the vendor receives to what the service requires.
• Identify special categories. Substance use disorder records governed by 42 C.F.R. Part 2, biometric identifiers, and information about minors may carry additional requirements.
• Ask about subcontractors. Identify every subcontractor that will touch the data, including hosting and support providers.
• Document the conclusion. If you decide that a vendor is not a business associate, record why, so the decision can be explained later.

Assess the vendor’s security program

• Request the vendor’s most recent risk analysis summary. A business associate is directly required to comply with the Security Rule, including conducting a risk analysis (45 C.F.R. 164.308(a)(1)).
• Request independent assurance. SOC 2 Type II reports, HITRUST certification, or comparable third-party assessments are useful evidence, but read the scope and exceptions, not just the cover page.
• Confirm encryption. Ask how data is encrypted in transit and at rest, and who holds the keys.
• Confirm access controls. Ask about multi-factor authentication, role-based access, and how access is removed when vendor staff leave.
• Confirm logging and monitoring. Ask what is logged, how long logs are kept, and whether they will be available to you after an incident.
• Confirm backup and recovery. Ask how quickly the vendor can restore service and data after an outage or ransomware event.
• Ask about incident history. Ask whether the vendor has reported breaches, and how it responded.

Review the business associate agreement

The agreement must include specific terms. Among them, it must (45 C.F.R. 164.504(e) and 164.314(a)):

• Limit use and disclosure. Permit only uses and disclosures that the covered entity itself could make, for the purposes of the service.
• Require safeguards. Require appropriate safeguards and compliance with the Security Rule for electronic protected health information.
• Require reporting. Require the vendor to report uses and disclosures not permitted by the agreement, security incidents, and breaches of unsecured protected health information.
• Flow down to subcontractors. Require the vendor to obtain the same restrictions from any subcontractor (45 C.F.R. 164.502(e)(1)(ii)).
• Support individual rights. Require the vendor to make information available for access, amendment, and an accounting of disclosures, where applicable.
• Open books to HHS. Make the vendor’s internal practices, books, and records available to the Secretary for determining compliance.
• Return or destroy at termination. Require return or destruction of the information at the end of the relationship, where feasible.
• Allow termination. Authorize the covered entity to terminate if the vendor violates a material term.

Negotiate the terms the regulation leaves open

• Breach notification timing. The regulation requires a business associate to notify the covered entity of a breach without unreasonable delay and no later than 60 calendar days after discovery (45 C.F.R. 164.410). Most covered entities negotiate a much shorter period, because their own notice clock to patients is also 60 days.
• Content of the notice. Require the vendor to provide the information you will need for patient and regulator notices, including the identity of affected individuals.
• Cost allocation. Decide who pays for notification, credit monitoring, forensic investigation, and regulatory response when the vendor causes the breach.
• Indemnification and insurance. Tie indemnity to the vendor’s breach of the agreement and confirm cyber insurance limits that match the risk.
• Offshore access. Decide whether data may be stored or accessed outside the United States.
• De-identified data and aggregation. Decide whether the vendor may de-identify data or use it to improve its products, and on what terms.
• Audit rights. Reserve the right to request updated security evidence each year.

Special cases: AI tools and analytics vendors

• Treat AI vendors like any other business associate. A documentation assistant, chatbot, or analytics tool that receives protected health information on your behalf is a business associate, and the same agreement and diligence apply.
• Ask whether your data trains the vendor’s models. A business associate may use protected health information only as its agreement permits, and the agreement generally cannot authorize uses the covered entity could not make itself. If you allow the vendor to use de-identified data, require de-identification under one of the two HIPAA methods, safe harbor or expert determination (45 C.F.R. 164.514(b)).
• Ask where prompts and outputs are stored. Conversation logs and generated notes are protected health information when they contain it, and they need the same retention and deletion terms as any other record.
• Confirm human review. For tools that draft clinical or billing content, decide who reviews the output before it enters the record.

Check Illinois overlays

• Personal information security. The Illinois Personal Information Protection Act requires reasonable security measures and a contract term requiring them when personal information is disclosed to a third party (815 ILCS 530/45). A covered entity or business associate that complies with the HIPAA privacy and security standards is deemed to comply with that Act (815 ILCS 530/50).
• Biometric information. If the vendor will collect or store fingerprints, face geometry, or voiceprints, the Biometric Information Privacy Act requires a public retention policy, informed written consent, and limits on disclosure (740 ILCS 14/15). HIPAA compliance does not satisfy those requirements.

After signature

• Record the agreement. Keep the signed agreement with the underlying services contract and add renewal and termination dates to your contract calendar.
• Limit access at launch. Grant the vendor only the system access the service requires.
• Train the people who manage the vendor. Staff who work with the vendor day to day should know what the agreement permits and how to report a problem.
• Reassess on a schedule. Refresh the vendor’s security evidence annually and whenever the scope of the service changes.
• Plan the exit. Know how you will retrieve your data and confirm its destruction when the relationship ends.

Watch the proposed Security Rule changes

In January 2025, HHS proposed amendments to the Security Rule that would, among other things, require business associates to verify in writing, at least once every 12 months, that they have deployed the technical safeguards the rule requires, and to notify covered entities within 24 hours after activating a contingency plan (90 Fed. Reg. 898 (Jan. 6, 2025)). These are proposals, not current law. Check their status before relying on them, but consider asking for similar commitments now, because they reflect what regulators already expect a careful covered entity to verify.

Diligence is proportionate. A vendor that stores a practice’s entire patient database deserves more scrutiny than one that occasionally receives a scheduling list. What matters is that the level of review matches the risk, and that the file shows the review was done before the data moved.