Business Associate Agreement (BAA)

The BAA strictly limits the vendor to using PHI only for the specific services outlined in the underlying agreement. Any secondary use—such as using patient data for product improvement, training internal models, or marketing—is prohibited unless explicitly authorized. The agreement must establish that the business associate cannot use or disclose PHI in any manner that would violate the HIPAA Privacy Rule if done by the covered entity itself.

The vendor must implement a formal Security Management Process to prevent, detect, contain, and correct security violations. This includes:

• Designating a Security Officer responsible for the security program.
• Conducting periodic Risk Assessments to identify vulnerabilities.
• Implementing a Sanction Policy for employees who fail to comply.
• Regularly reviewing records of system activity, such as audit logs and access reports.

The agreement mandates controls to protect physical access to electronic information systems and the facilities housing them. This includes Facility Access Controls to limit physical entry to authorized personnel and Workstation Security to restrict access to devices that handle PHI. The vendor must also define procedures for the final disposition of hardware and electronic media to ensure PHI is rendered unrecoverable.

The vendor is obligated to implement technology that protects PHI and controls access to it. Key requirements include:

• Access Controls: Assigning unique user IDs and automatic logoff.
• Audit Controls: Recording and examining activity in systems containing PHI.
• Integrity Controls: Ensuring PHI is not improperly altered or destroyed.
• Transmission Security: Encrypting PHI whenever it is transmitted over an electronic network to prevent unauthorized interception.

The BAA establishes a strict timeline for incident response. The business associate must report any Security Incident or Breach of Unsecured PHI to the covered entity without unreasonable delay, typically within 24 to 72 hours of discovery. The notification must identify the nature of the breach, the types of data involved, and the steps being taken to mitigate harm. The vendor is often required to indemnify the covered entity for costs arising from the vendor's negligence.

The vendor cannot simply outsource risk. If the business associate delegates any function involving PHI to a subcontractor, it must enter into a written agreement that imposes the same privacy and security obligations on the subcontractor. This creates a chain of liability, ensuring that PHI remains protected even as it flows through multiple layers of service providers, from cloud infrastructure to specialized analytics tools.