The HIPAA Business Associate Agreement Checklist: Every Clause 45 CFR 164.504(e) Requires

What does a business associate agreement have to contain?

Ten specific commitments, listed in 45 CFR 164.504(e)(2), plus a termination right for the covered entity. HHS publishes sample provisions covering each one, so the content is not a matter of negotiation; the only questions are whether your template has them all and whether you have one signed with every vendor that touches PHI.

The checklist below follows the regulation clause by clause. Lay your current template beside it and tick.

The checklist from 164.504(e)

The agreement must establish the permitted and required uses and disclosures of PHI by the business associate, and it may not authorize anything the covered entity could not do itself (with narrow exceptions for the BA's own management and administration and for data aggregation).

Then the business associate must agree to each of the following.

#	Clause	Citation
1	Not use or further disclose PHI other than as the contract permits or the law requires	164.504(e)(2)(ii)(A)
2	Use appropriate safeguards, and comply with the Security Rule for ePHI, to prevent unpermitted use or disclosure	164.504(e)(2)(ii)(B)
3	Report any use or disclosure not provided for by the contract, including breaches of unsecured PHI as required by 164.410	164.504(e)(2)(ii)(C)
4	Ensure any subcontractor that handles PHI agrees to the same restrictions and conditions	164.504(e)(2)(ii)(D)
5	Make PHI available so the covered entity can meet individuals' right of access under 164.524	164.504(e)(2)(ii)(E)
6	Make PHI available for amendment under 164.526 and incorporate amendments	164.504(e)(2)(ii)(F)
7	Provide the information needed for an accounting of disclosures under 164.528	164.504(e)(2)(ii)(G)
8	Where the BA carries out a covered entity's Privacy Rule obligation, comply with the requirements that apply to that obligation	164.504(e)(2)(ii)(H)
9	Make internal practices, books and records available to the Secretary of HHS for compliance review	164.504(e)(2)(ii)(I)
10	At termination, return or destroy all PHI if feasible, and if not, extend the protections and limit further use	164.504(e)(2)(ii)(J)
11	Authorize the covered entity to terminate the contract if the BA violates a material term	164.504(e)(2)(iii)

Two additions the regulation does not require but every good agreement includes: a breach notification deadline in days (the rule says without unreasonable delay and no later than 60 calendar days; most covered entities write a much shorter number in), and a named contact on each side.

Who is a business associate

The definition in 45 CFR 160.103 is broad on purpose. A business associate is any person or organization, outside your own workforce, that creates, receives, maintains or transmits PHI on your behalf, or that provides services to you involving PHI. The HHS business associates FAQ gives the usual examples.

• Billing companies, clearinghouses acting for you, and revenue cycle vendors
• IT providers and managed service providers with access to systems holding ePHI
• Cloud hosts for your EHR, email, file storage and backups
• Transcription, coding, answering and telehealth services
• Lawyers, accountants and consultants who need PHI to do the work
• Shredding and records storage companies
• Subcontractors of any of the above

Not business associates: your own employees, other providers you share PHI with for treatment, a health plan sponsor acting in that role, and true conduits. The conduit exception is narrow: the postal service and internet carriers that move data without storing it. HHS says it does not cover a vendor that keeps ePHI on its servers.

Cloud vendors

HHS settled the cloud question in its 2016 guidance. A cloud service provider that stores ePHI is a business associate, even if the data is encrypted end to end and the provider cannot decrypt it. The practical consequences:

1. Sign the BAA before ePHI goes in, not after. The large platforms will sign, often only on specific plan tiers; the consumer tier of the same product frequently will not, and a free personal account is never covered.
2. Read what the BAA covers. Many cloud agreements list the specific services included. A service missing from that list is outside the agreement.
3. Configure the service the way the BAA assumes. The vendor's agreement does not help if MFA is off and sharing links are public.

Running the inventory

A BAA checklist is only as good as the list of vendors it is applied to, and that list comes out of the risk analysis. Our guide to the HIPAA risk analysis explains where vendor inventory sits in it. Once a year, confirm every vendor has a signed agreement that still names the services you use, and that nobody added a new tool in between; the HIPAA annual review builds that into the calendar. The agreement itself belongs in the policy set, which the policies a small practice needs covers.

Where AccuSights fits

We build the vendor inventory during the risk analysis, review every BAA against the clauses above and chase the ones that are missing, with a named engineer rather than a ticket queue and remediation included. We do not certify HIPAA compliance, because no one can. Start with the HIPAA framework page or book a free Risk Diagnosis and bring your vendor list.