Business associate agreement obligations at a glance

Business associate agreements are among the most widely executed contracts in healthcare and among the least actively managed. A mid-size health system may hold several hundred, covering everything from claims processing and transcription to cloud infrastructure and shredding services. They are usually executed on standard paper, filed, and revisited only when a security questionnaire or an incident makes someone look.

The filing is the problem. A BAA is not a permission slip. It creates a set of ongoing obligations on the business associate, a corresponding set of oversight expectations on the covered entity, and several duties that survive termination by years. None of those is satisfied by having the executed document available, and none of them generates a routine transaction that would prompt a review.

This datasheet sets out the obligations a business associate agreement creates, who owns each one, the clocks that govern them, and the evidence each produces when a regulator, an auditor or a customer asks. It is written for privacy, vendor management and contract operations teams managing a BAA portfolio at scale.

Obligations on the business associate

The business associate side carries most of the operative duties, and several of them are time-bound in ways that are easy to miss when the agreement is treated as a file.

• Permitted use and disclosure, protected health information may be used or disclosed only as the agreement permits or as law requires, which constrains secondary uses including analytics and product improvement
• Safeguards, appropriate administrative, physical and technical safeguards must be implemented, and the agreement frequently specifies evidence the covered entity may request
• Incident and breach reporting, security incidents and breaches must be reported within a defined period, and negotiated agreements often set a period considerably shorter than the regulatory outer limit
• Subcontractor flow-down, any subcontractor creating, receiving, maintaining or transmitting protected health information on the business associate’s behalf must agree to equivalent restrictions
• Individual rights support, access, amendment and accounting of disclosure requests must be supported within timeframes that let the covered entity meet its own deadlines

Two of these carry disproportionate risk. Breach reporting is the obligation that will be examined first after any incident, and the contractual clock rather than the regulatory one is what the parties are measured against. Subcontractor flow-down is the obligation covered entities are least able to evidence, because the flow-down happens one step removed and is rarely reported upward unless the agreement requires it. A covered entity that has never asked for a subcontractor list generally does not have one, and will not obtain it quickly during an incident.

Obligations on the covered entity

Covered entities frequently treat the BAA as a control they impose rather than one they also carry. Several duties sit on their side and are examined during review.

• Due diligence before disclosure. Satisfactory assurance that the business associate will safeguard information is expected before protected health information is shared, and it should be evidenced rather than assumed
• Response to known breach of terms. Where the covered entity knows of a pattern or practice constituting a material breach, it is expected to act, which requires knowing in the first place
• Maintaining the agreement inventory. The covered entity should be able to identify every business associate relationship, including those created through operational arrangements that did not go through procurement
• Coordinating notification. Breach notification duties to individuals and regulators remain with the covered entity, so the contractual reporting flow has to feed an internal process that can act quickly
• Termination handling. Return or destruction of protected health information at the end of the relationship, and documentation of what was returned or destroyed, remains a covered entity concern

A five-step management sequence

Step 1, Reconcile the BAA inventory against actual data flows

Compare the executed BAA list to vendor spend, system integrations and data transfer records. Relationships that handle protected health information without an executed agreement are the highest-priority finding, and they are usually found this way rather than through contract review.

Step 2, Extract obligations rather than filing agreements

Pull reporting clocks, safeguard evidence rights, flow-down requirements, individual rights support timeframes and termination duties out of each agreement as records with owners. Standard paper still varies more than expected once amendments and vendor paper are included, and the variation concentrates in exactly the terms that matter, notification periods and evidence rights.

Step 3, Normalize the reporting clocks

Identify the shortest notification period across the portfolio and build the internal response process around it. Managing to the regulatory deadline while holding agreements with tighter contractual clocks guarantees late notice on the agreements that matter most.

Step 4, Require subcontractor evidence

Ask business associates to confirm that flow-down agreements are in place and to identify subcontractors handling protected health information. Making this an annual attestation converts an unverifiable clause into a checkable record.

Step 5, Close out at termination

Trigger the return or destruction obligation from the contract end date, obtain confirmation, and record it. This obligation is missed more than any other because it falls due exactly when everyone involved has moved on.

What evidence a review actually asks for

A privacy review, a customer security assessment or a regulatory inquiry does not ask whether business associate agreements exist. It asks for something more specific. Which vendors handle protected health information, and is there an executed agreement for each. What is the notification period in each agreement, and what is the process that meets it. Which business associates use subcontractors, and what evidence exists that flow-down occurred. When relationships ended, what happened to the information, and how is that documented. Each of those is a report if obligations were extracted into records, and a manual review of several hundred documents if they were not. Organizations that have done this work also find it substantially reduces the effort of responding to customer assessments, because the same records answer both. The pattern is common across healthcare contracting and is set out more fully in the healthcare CLM audit checklist.

Obligation, owner, clock and evidence

The table summarizes the principal obligations, who typically owns them and what evidence each should produce.

A business associate agreement portfolio is a set of obligations, not a set of documents. The obligations have owners on both sides, clocks that are frequently shorter than the regulatory equivalents, and duties that outlive the commercial relationship. Extracting them into monitored records, reconciling the inventory against actual data flows and closing out termination duties turns a filing exercise into a control that produces its own evidence, which is what any review is going to test. The work is also incremental, because the portfolio can be sequenced by data sensitivity and vendor criticality rather than processed alphabetically.

For related guidance, see The compliance guide to BAA tracking across vendors, IATF 16949 supplier quality agreements, a control guide and EHR vendor contracts: interfaces, export and data access.

Aavenir Healthcare PracticeHealthcare vendor obligations, privacy terms and post-signature compliance