# HIPAA business associate agreement (BAA) review checklist

> **Review with counsel before use.** This checklist helps you check a BAA against the clauses the HIPAA rules require. It is not legal advice and it is not a BAA. Have your attorney review any agreement before you sign it.
>
> Sources: 45 CFR 164.504(e) and 164.314(a). Checklist from AccuSights, https://accusights.com/templates

---

**Vendor:** ______________________________  **Service:** ______________________________

**Agreement version and date:** ______________  **Reviewed by:** ______________  **Date:** ______________

## Required clauses

The agreement must establish the permitted and required uses and disclosures of PHI by the business associate, and it may not authorize anything the covered entity could not do itself (with narrow exceptions for the business associate's own management and administration and for data aggregation).

| # | The business associate agrees to | Citation | In the agreement? | Section |
|---|---|---|---|---|
| 1 | Not use or further disclose PHI other than as the contract permits or the law requires | 164.504(e)(2)(ii)(A) | [ ] | |
| 2 | Use appropriate safeguards, and comply with the Security Rule for ePHI | 164.504(e)(2)(ii)(B) | [ ] | |
| 3 | Report any use or disclosure not provided for by the contract, including breaches of unsecured PHI under 164.410 | 164.504(e)(2)(ii)(C) | [ ] | |
| 4 | Ensure any subcontractor that handles PHI agrees to the same restrictions and conditions | 164.504(e)(2)(ii)(D) | [ ] | |
| 5 | Make PHI available for the individual's right of access under 164.524 | 164.504(e)(2)(ii)(E) | [ ] | |
| 6 | Make PHI available for amendment under 164.526 and incorporate amendments | 164.504(e)(2)(ii)(F) | [ ] | |
| 7 | Provide the information needed for an accounting of disclosures under 164.528 | 164.504(e)(2)(ii)(G) | [ ] | |
| 8 | Where it carries out a covered entity's Privacy Rule obligation, comply with the requirements that apply to it | 164.504(e)(2)(ii)(H) | [ ] | |
| 9 | Make internal practices, books and records available to the Secretary of HHS | 164.504(e)(2)(ii)(I) | [ ] | |
| 10 | At termination, return or destroy all PHI if feasible; if not, extend the protections and limit further use | 164.504(e)(2)(ii)(J) | [ ] | |
| 11 | The covered entity may terminate the contract if the business associate violates a material term | 164.504(e)(2)(iii) | [ ] | |
| 12 | Security Rule terms for ePHI: comply with Subpart C, flow down to subcontractors, report security incidents | 164.314(a)(2) | [ ] | |

## Terms the rule does not require but most agreements should state

- [ ] A breach notification deadline in days (the rule's outer limit is without unreasonable delay and no later than 60 calendar days after discovery; most covered entities write a shorter number)
- [ ] A named contact on each side for incidents
- [ ] The specific services the agreement covers (cloud agreements often list them; a service not listed is outside the agreement)
- [ ] What "return or destroy" means for backups and logs
- [ ] Audit rights, insurance minimums and indemnities (commercial terms, negotiable)

## Before PHI goes to the vendor

- [ ] The vendor really is a business associate (it creates, receives, maintains or transmits PHI for you). Not sure? https://accusights.com/tools/do-i-need-a-baa
- [ ] The agreement is signed by both sides
- [ ] The service is configured the way the agreement assumes (for example MFA on, sharing restricted, the right plan tier)
- [ ] The vendor is in your risk analysis and your vendor inventory, with an owner and a renewal date
- [ ] Counsel has reviewed the agreement

More on BAAs: https://accusights.com/blog/hipaa-business-associate-agreement-checklist