Guide · HIPAA · Contracts

Business Associate Agreement Clauses Worth Reading Before You Sign

Most vendor forms include the required terms. The differences lie in permitted uses, reporting deadlines, costs, and termination.

By Lincoln Square Law · 9-minute read

Business associate agreements tend to be signed without much reading. The vendor sends its standard form, the practice’s office manager or IT consultant confirms that it says “business associate agreement” at the top, and it goes into a folder. Most of these forms contain the provisions HIPAA requires. The trouble is in what they add, what they leave vague, and what they quietly shift back onto the practice. When a vendor has a breach, the practice discovers what its agreement actually says about reporting deadlines, cooperation, costs, and who pays. This guide covers the clauses worth reading closely before signing, and the ones worth negotiating.

What the rule requires

A covered entity may disclose PHI to a business associate, or allow it to create, receive, maintain, or transmit PHI on the entity’s behalf, only if it obtains satisfactory assurances, documented in a written contract, that the business associate will appropriately safeguard the information (45 C.F.R. 164.502(e)). The Privacy Rule lists what the contract must contain (45 C.F.R. 164.504(e)(2)). The contract must establish the permitted and required uses and disclosures, and it must require the business associate to:

• Limit use and disclosure to what the contract permits or the law requires.
• Use appropriate safeguards and comply with the Security Rule for electronic PHI.
• Report any use or disclosure not provided for by the contract, including breaches of unsecured PHI.
• Bind subcontractors that handle PHI to the same restrictions.
• Support patient rights by making PHI available for access, amendment, and an accounting of disclosures.
• Comply with the Privacy Rule to the extent it carries out the covered entity’s obligations.
• Open its books to HHS for determining compliance.
• Return or destroy PHI at termination, if feasible.

The contract must also authorize the covered entity to terminate it if the business associate violates a material term (45 C.F.R. 164.504(e)(2)(iii)). The Security Rule adds parallel requirements for electronic PHI, including that the business associate report security incidents (45 C.F.R. 164.314(a)). A form that omits any of these is deficient on its face, but most vendor forms include them. The clauses below are where the real differences lie.

Permitted uses, and the vendor’s own purposes

Read the permitted-use section first. A well-drafted agreement ties the vendor’s use of PHI to the services it provides to the practice. Many vendor forms go further and allow the vendor to use PHI for its “internal business purposes,” to “improve its products and services,” or to create aggregated or de-identified data sets for its own use.

Some of this is permitted. The rule allows a business associate agreement to let the vendor use PHI for its own proper management and administration and, in limited cases, to provide data aggregation services relating to the covered entity’s health care operations (45 C.F.R. 164.504(e)(2)(i), (e)(4)). De-identification is more specific. HHS guidance states that a covered entity may use a business associate to de-identify PHI on its behalf only to the extent the business associate agreement authorizes it. Once the data is properly de-identified, the Privacy Rule no longer governs it. A clause that permits de-identification therefore permits the vendor to build a data asset from the practice’s patients. The practice should decide whether it agrees to that, and if so under which de-identification method.

Reporting: what, when, and to whom

The reporting clause matters more than any other when something goes wrong. Under the Breach Notification Rule, a business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and in no case later than sixty calendar days after discovery (45 C.F.R. 164.410(b)). The covered entity’s own sixty-day clock to notify patients generally runs from when it discovers the breach, which may be when the vendor tells it.

A practice should not accept the regulatory outer limit as its contract term. Sixty days leaves almost no time for the practice to investigate, notify patients, notify HHS, and, in Illinois, notify the Attorney General within five business days of notifying HHS (815 ILCS 530/50). Negotiate for a short initial notice, often a few business days after discovery, followed by the details the practice needs to notify individuals. The contract should also say what the report must contain: the individuals affected, the data involved, what happened, and what the vendor is doing about it.

Watch the definition of “security incident.” The Security Rule defines it broadly enough to include unsuccessful attempts, and vendors often add language that treats routine unsuccessful attempts, such as port scans and blocked logins, as reported by the agreement itself. That is a sensible accommodation. It should not extend to successful intrusions that the vendor decides were harmless.

Subcontractors

A vendor that uses its own vendors to store or process PHI must obtain the same assurances from them (45 C.F.R. 164.502(e)(1)(ii), 164.504(e)(5)). Most cloud-based services depend on a chain of subcontractors: hosting, backup, customer support, analytics. The agreement should require the vendor to flow down the same terms, and the practice should ask for a list of subcontractors that will handle its data. A clause that allows the vendor to send PHI offshore should be a deliberate decision, not a default.

Cooperation, costs, and indemnity

HIPAA does not say who pays for a breach. The contract does. Vendor forms often say nothing about the cost of notifying patients, providing credit monitoring, responding to regulators, or defending claims. Some expressly exclude those costs, or limit the vendor’s total liability to the fees the practice paid over the prior year, which for a scheduling or reminder tool may be a small number.

The regulatory exposure is real. A covered entity can be liable for a civil money penalty based on the acts of a business associate that is acting as its agent (45 C.F.R. 160.402(c)). The practice should negotiate for:

• Reimbursement of reasonable breach response costs caused by the vendor, including notification and credit monitoring.
• Indemnity for third-party claims and regulatory penalties arising from the vendor’s breach of the agreement.
• A separate liability cap, or no cap, for data protection obligations, rather than folding them into the general limit in the services agreement.
• Cooperation with the practice’s investigation, including access to logs and forensic findings relevant to the practice’s data.
• Insurance, with cyber liability coverage at a stated minimum.

Whether a given vendor will agree depends on leverage. A practice that cannot move a large vendor’s terms should at least know what the agreement says, so that its own insurance and incident response plan account for the gap.

Order of precedence

Business associate agreements are often signed alongside a master services agreement, terms of service, and an online privacy policy that the vendor can change unilaterally. Look for the clause that says which document controls if they conflict. The business associate agreement should control on anything touching PHI, and the vendor should not be able to change its data practices by updating a web page.

Termination and return of data

At termination, the vendor must return or destroy all PHI, if feasible, and if not feasible, extend the agreement’s protections to the information and limit further use (45 C.F.R. 164.504(e)(2)(ii)(J)). The contract should say which it will be, in what format data will be returned, and how destruction will be certified. A practice changing EHR or billing vendors needs its data back in a usable form, and the time to negotiate that is before signing, not at the end of the relationship.

The practice also has a duty of its own. If it knows of a pattern of activity or practice by the vendor that amounts to a material breach, it must take reasonable steps to cure the breach or end the violation, and terminate the contract if those steps fail (45 C.F.R. 164.504(e)(1)(ii)).

What may change

HHS’s January 2025 proposal to strengthen the Security Rule would add obligations that belong in future agreements (90 Fed. Reg. 898). According to HHS’s fact sheet, business associates would have to verify at least once every twelve months, through a written analysis by a subject matter expert and a written certification, that they have deployed the technical safeguards the rule requires. Business associates would also have to notify covered entities no later than twenty-four hours after activating their contingency plans. As of this writing the proposal has not been finalized. A practice renewing agreements now can ask for annual written assurances and prompt notice of contingency activation by contract, without waiting for the rule.

Illinois law adds a related requirement for personal information in general. A data collector that discloses Illinois residents’ personal information under a contract must require the recipient to maintain reasonable security measures (815 ILCS 530/45). A HIPAA-regulated entity that complies with HIPAA is deemed compliant with the Illinois act (815 ILCS 530/50), apart from the Attorney General notice, which is one more reason to keep business associate agreements current.

A short review routine

Before signing, confirm the required terms are present, then read the permitted uses, the reporting clause, the subcontractor terms, the cost and liability provisions, the order of precedence, and the termination terms. Keep a list of every business associate, the date of the agreement, and when it was last reviewed. That list is also the starting point for the practice’s risk analysis, because every vendor on it is a place where the practice’s patient data lives.