BAA requirements: a clause-by-clause checklist

How to use this BAA requirements checklist

Open the vendor's BAA next to this page. Tick each box only when you find the clause; note the section number beside it.

• Required lines come from 45 CFR 164.504(e)(2) (opens in a new tab) (Privacy Rule) or 45 CFR 164.314(a)(2) (opens in a new tab) (Security Rule). A missing required clause means the agreement doesn't meet HIPAA's minimum.
• Common practice lines are negotiable. HIPAA doesn't require them, but practices often ask for them.
• HHS sample references point to the matching section of the sample provisions HHS published in the Federal Register in 2002 (opens in a new tab). HHS's current web version may letter them differently.

The whole list fits on one page; copy it into your vendor file. To draft your own instead, use our HIPAA BAA template.

Permitted and required uses and disclosures

• Required. Establishes the vendor's permitted and required uses and disclosures of PHI, and doesn't authorize uses that would violate the Privacy Rule if your practice made them. 164.504(e)(2)(i). HHS sample: Permitted Uses and Disclosures.
• Required. The vendor will not use or further disclose PHI except as the contract permits or the law requires. 164.504(e)(2)(ii)(A). HHS sample: Obligations (a).
• Optional by rule. If the vendor may use PHI for its own management and administration or for data aggregation, the contract says so expressly. 164.504(e)(2)(i)(A)–(B), (e)(4).
• Common practice. Uses are listed specifically, not left as "to provide and improve services."

Why it matters: the vendor may use PHI "only as permitted or required by its business associate contract" (45 CFR 164.502(a)(3) (opens in a new tab)). A vague clause gives it room you didn't intend.

Safeguards and Security Rule compliance

• Required. The vendor will use appropriate safeguards and comply with Subpart C of Part 164 (the Security Rule) for electronic PHI. 164.504(e)(2)(ii)(B); 164.314(a)(2)(i)(A). HHS sample: Obligations (b).
• Common practice. Named controls such as encryption, multi-factor authentication and access logging, plus where data is stored.

Why it matters: the Security Rule requires risk-based Security Rule safeguards, and the BAA is your written evidence that the vendor accepted them. A January 2025 proposed rule (opens in a new tab) would add a required clause on notice when a vendor activates its contingency plan. It was still a proposal when we checked in October 2026.

Reporting breaches and security incidents

• Required. The vendor will report any use or disclosure not provided for by the contract, including breaches of unsecured PHI as required by 164.410. 164.504(e)(2)(ii)(C). HHS sample: Obligations (d).
• Required. The vendor will report any security incident it becomes aware of. 164.314(a)(2)(i)(C).
• Common practice. A specific deadline shorter than the regulatory outer limit, a named contact, and what the report must contain.

Why it matters: 45 CFR 164.410 (opens in a new tab) gives a business associate until "no later than 60 calendar days after discovery," and you have your own deadlines under the breach notification rule. The 2002 sample set no timeframe at all.

Subcontractor flow-down

• Required. Any subcontractor that creates, receives, maintains or transmits PHI for the vendor agrees in writing to the same restrictions and conditions. 164.504(e)(2)(ii)(D); 164.314(a)(2)(i)(B). HHS sample: Obligations (e).
• Common practice. The vendor lists current subcontractors with PHI access and gives notice before adding one.

Why it matters: since the 2013 Omnibus Final Rule, obligations run "down the chain" through every tier (Federal Register (opens in a new tab)). See subcontractor BAAs.

Patient rights and HHS access to records

• Required. Makes PHI available for patient access under 164.524. 164.504(e)(2)(ii)(E). HHS sample: Obligations (f).
• Required. Makes PHI available for amendment under 164.526. 164.504(e)(2)(ii)(F). HHS sample: Obligations (g).
• Required. Makes available the information needed for an accounting of disclosures under 164.528. 164.504(e)(2)(ii)(G). HHS sample: Obligations (i)–(j).
• Required. Where the vendor carries out your Privacy Rule obligations, it complies with them. 164.504(e)(2)(ii)(H).
• Required. Makes its internal practices, books and records available to HHS. 164.504(e)(2)(ii)(I). HHS sample: Obligations (h).
• Common practice. Turnaround times in days for each request.

Termination and return or destruction of PHI

• Required. At termination, the vendor returns or destroys all PHI if feasible, or extends the contract's protections and limits further use if not. 164.504(e)(2)(ii)(J). HHS sample: Term and Termination (c).
• Required. Your practice may terminate if the vendor violates a material term. 164.504(e)(2)(iii). HHS sample: Term and Termination (b).
• Common practice. A destruction deadline, written certification, and treatment of backups.

Why it matters: if you know of a pattern of material breach, 45 CFR 164.504(e)(1)(ii) (opens in a new tab) expects you to cure it, end it, or terminate where feasible.

Red flags in vendor-drafted BAAs

These are considerations for your review, not legal rules. Illustrative examples:

• No breach-reporting timeframe, or one tied only to "applicable law."
• Broad data use "to improve services," develop products or train models, with no limit to de-identified data.
• Silence on subcontractors, or a right to add them without notice.
• No return-or-destroy clause, or indefinite retention "for business purposes."
• Liability caps that hollow out obligations, such as a cap equal to one month's fees for a breach.
• Coverage limited to certain products or plans you aren't buying. Check our notes on vendors' HIPAA claims.

Medfy signs a BAA with each practice; see how Medfy handles patient data. If you're not sure which of your tools collect patient information, the free marketing audit flags risks such as ad pixels on patient forms.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

What must a business associate agreement include?

At minimum: the vendor's permitted uses of PHI, a promise not to use it otherwise, safeguards and Security Rule compliance, reporting of improper uses, security incidents and breaches, written flow-down to subcontractors, help with patients' access, amendment and accounting rights, HHS access to its records, return or destruction of PHI at the end, and your right to terminate. Have counsel confirm the wording.

Does a BAA have to set a breach notification deadline?

The regulation requires the BAA to make the vendor report breaches, but it doesn't require a specific deadline in the contract. The deadline comes from 45 CFR 164.410: without unreasonable delay and no later than 60 calendar days after discovery. You can still write a shorter window into the BAA so you have time to meet your own duties. Have your attorney review the clause.

Is a BAA required for vendors outside the US?

The definition of a business associate turns on what the vendor does with PHI, not where it is located, so an overseas vendor handling your patients' information still needs a BAA. Practical issues follow: enforcing the contract abroad, and knowing where data is stored. Some practices restrict offshore storage or subcontracting in the BAA. Confirm the approach with your compliance officer or attorney.

Can a BAA limit the vendor's liability?

HIPAA doesn't regulate liability caps or indemnities; those are ordinary contract terms. A cap can't remove the duties the regulation requires the BAA to contain, and it doesn't change the vendor's direct liability to HHS. It can leave your practice paying for a vendor's breach, such as patient notification costs. Have counsel review caps before you sign.