164.308(b)(1) Business associate contracts and arrangements

What 164.308(b)(1) asks before a business associate touches ePHI

A covered entity may let a business associate create, receive, maintain or transmit electronic protected health information only after it has obtained satisfactory assurances that the vendor will appropriately safeguard that information. Under 45 CFR 164.308(b)(1), those assurances must meet 164.314(a) and be documented in a written contract or other arrangement, which is the implementation specification that the rule requires. The same logic applies one tier down: under 164.308(b)(2), a business associate must obtain satisfactory assurances from any subcontractor before that subcontractor handles ePHI. The risk the standard addresses is simple. Once ePHI leaves the organization's control without safeguards written into an agreement, the covered entity has little leverage over how it is protected, and every downstream party that touches the data widens that exposure. The practical difficulty is volume and drift. A mid-sized covered entity may run dozens of vendors that touch ePHI, from hosting and billing to transcription and IT support, and each contract may describe security obligations in different words, with different breach notice timing and different rules for returning or destroying data. Many organizations find that the signed agreement is the easy part. The harder question is whether anyone checks, after signature, that the vendor still deploys the safeguards it promised. For that reason, the January 2025 proposed rule (90 FR 898) would add a duty for covered entities to obtain written verification from business associates at least once every 12 months that required technical safeguards are deployed. That change was proposed, not finalized, and the rule was not final as of October 2026, so confirm the current status before building it into a contract template. Start by inventorying every party that receives, stores or transmits ePHI for you, including the subcontractors your vendors use. For each one, confirm that a written contract or other arrangement exists, that it addresses the 164.314(a) requirements, and that someone owns the performance review. NIST SP 800-66 Rev. 2 describes the same sequence, with a process for measuring contract performance and terminating the contract when security requirements are not met. A contract with a business associate is not a HIPAA certification, and it does not show that the vendor is compliant. It is the document that makes the assurance enforceable, so the evidence you keep should cover both the signed terms and the checks that followed.

Which vendors and relationships fall under the business associate standard

Whether a vendor needs a business associate contract depends on whether it creates, receives, maintains or transmits ePHI for you, and on the chain of parties that touches it. The cards below cover the scoping decisions that change the contract and review work under 164.308(b)(1). Your risk analysis decides which relationships are in scope and how deep each review should go.

Hosting and infrastructure providers

A cloud host, colocation provider or managed hosting company that stores or processes ePHI on your behalf is a business associate, even if it never opens the data. Encryption at rest or a provider's lack of access to keys does not remove it from scope. Check whether the provider's own contract terms and any shared responsibility model cover the safeguards your risk analysis requires, and confirm that the business associate agreement is signed before any ePHI is placed in its environment.

Billing, coding and transcription services

Vendors that bill, code, transcribe or dictate using patient records are business associates because they handle ePHI as part of a service for you. These relationships often run through staff accounts, portals or file transfers, so the ePHI may pass through several systems you do not own. Ask each vendor where recordings, drafts and exports are stored and how long they remain there, because those locations determine what the contract must cover.

Managed IT and security providers

A managed service provider that administers your servers, endpoints, email or backups can see ePHI even when that is not its purpose. Administrative access often exposes every system holding ePHI, so the relationship is in scope regardless of the service label. Confirm which systems the provider can reach, whether it uses remote management tools, and how its own staff are authorized, since these details shape both the assurances you need and the depth of review.

Subcontractors further down the chain

When a business associate passes ePHI to its own vendor, that vendor is a subcontractor and the business associate must obtain satisfactory assurances from it under 164.308(b)(2). Your own contract does not reach that subcontractor directly, so you need to ask your business associate for its subcontractor list and confirm that its agreements flow the same safeguards down. A chain can run several tiers, and each tier that creates, receives, maintains or transmits ePHI needs its own written assurance.

Vendors that never access ePHI

A vendor that never creates, receives, maintains or transmits ePHI is generally outside the business associate standard. Examples include a office supply company, a facilities contractor with no system access, or a software tool that runs only on data with identifiers removed. Document the basis for this conclusion in the risk analysis, and revisit it if the vendor's access changes, such as when a support engagement starts to require a screen share into a patient system.

Data flows that change the answer

The same vendor can be in scope or out of scope depending on how data reaches it. A vendor that receives a feed of identifiable records is in scope, while one that receives only aggregated, de-identified output may not be, provided the de-identification meets the standard you rely on. Map each data flow, including email, API integrations, analytics exports and vendor-hosted dashboards, because a single unmapped flow can bring a vendor into scope and leave you with an unsigned relationship.

How an assessor tests the business associate standard

This table walks through each assessor test step for 164.308(b)(1), the evidence requested for it, and the findings that most often appear. Read it as a checklist: if you cannot produce the evidence in the right-hand column for each step, expect that step to become a finding. An assessor reports findings to the organization and does not certify compliance.

Test step	What the assessor checks	Evidence requested	Common finding
Vendor inventory	Every business associate and subcontractor is identified and compared with the systems and data stores that hold ePHI	Current business associate register, data flow diagrams, system inventory with ePHI locations	Vendors missing from the inventory, including tools adopted by individual departments
Contract sampling	A selection of executed contracts or other arrangements is pulled and checked against the vendor inventory	Signed business associate agreements or equivalent arrangements, with signature dates and version history	Vendor relationships with no executed agreement on file
Required assurances	Each sampled agreement contains the safeguard assurances required by 164.314(a)	Agreement text mapped to 164.314(a) requirements, with the clause locations marked	Agreements that omit reporting, safeguard or return-or-destruction terms
Expiry and renewal	Agreements are current for the period in which the vendor still handles ePHI	Contract end dates, renewal records and vendor status reports	Expired agreements where the vendor still receives or stores ePHI
Subcontractor chain	Each business associate has passed the same assurances to its subcontractors that handle ePHI	Subcontractor lists from each business associate, and the subcontractor agreements or equivalent terms	Unsigned subcontractor terms or subcontractors that the covered entity has never heard of
Performance measurement	A documented process exists to measure whether vendors meet their security obligations	Vendor review procedure, completed questionnaires, audit reports received, and review meeting records	No periodic review after onboarding, or reviews that never reach a decision
Termination for failure	The organization can end a vendor relationship when security requirements are not met	Termination clauses, escalation procedure, and any records of vendors that were placed on remediation or exited	Contracts with no termination right tied to security failures
Data return or destruction	On exit, ePHI held by the vendor and its subcontractors is returned or destroyed as the contract requires	Offboarding checklist, destruction certificates or written confirmations from the vendor	No record that the vendor returned or destroyed ePHI after the contract ended

How to implement the business associate standard in sequence

This sequence turns 164.308(b)(1) from a legal obligation into a working inventory, a set of signed agreements and a schedule for checking vendors over time. Each step produces a record you can show an assessor or OCR investigator.

Identify every business associate and subcontractor
Start by listing every outside party that will create, receive, maintain or transmit ePHI for you. Include cloud hosts, billing and clearinghouse vendors, managed IT providers, transcription services and any app or platform that stores patient data. Ask each vendor whether it uses subcontractors that touch ePHI, because the rule applies one tier down as well. The output is a vendor register that records the vendor, the service, the ePHI involved, where it is stored and who owns the relationship internally. Confirm the register with your privacy and security leads before moving to the next step.
Sort vendors by ePHI exposure
Using the register, mark which vendors hold ePHI in production, which only see it occasionally and which have no access at all. Your risk analysis should drive how deep each review goes, so record the reasoning next to each rating. Vendors with no ePHI access may fall outside the standard, but document that conclusion rather than assuming it. The output is a classified register that shows which relationships need a full assurance review and which need only a scoped confirmation.
Compare existing contracts against the required terms
Review each current agreement against the assurances that 164.314(a) requires, including safeguarding ePHI, reporting security incidents, ensuring subcontractors agree to the same restrictions and returning or destroying ePHI at the end of the relationship. Your legal team should own this review, and a qualified reviewer should confirm the technical terms. The output is a contract gap list naming each vendor, the missing or weak clause and the owner responsible for fixing it. Where the gap list is long, prioritize vendors with production ePHI access.
Define how you will measure vendor performance
Before signing or renewing, decide what evidence you will ask for and how you will judge it. Examples include current security assessment reports, evidence of encryption and access controls, incident notification records and subcontractor lists. The NIST guide frames this as a process for measuring contract performance. Write the criteria into a vendor review standard that names who reviews what. The output is a documented review procedure and a request list you can send to each vendor.
Set the conditions for ending a relationship
Decide in advance what happens when a vendor fails to meet security requirements, such as a missed remediation, an unreported incident or refusal to provide evidence. Agree on the escalation path, the decision maker and the steps for moving or securing ePHI if the contract ends. The NIST guide lists terminating the contract when security requirements are not met as a key activity. The output is a termination and exit procedure, reflected in the contract wherever possible, so the decision does not depend on negotiation at the moment of failure.
Execute written contracts or other arrangements before data moves
Sign the business associate agreement or other written arrangement with each vendor before it creates, receives, maintains or transmits ePHI. Confirm that subcontractor assurances flow down in the vendor's own agreements. Store signed copies in a controlled repository with the effective date and the named signatories. The output is a signed agreement set and a check that no ePHI transfer began before its agreement was in force. Keep in mind that the contract is only one part of the evidence, so the vendor register and review records must stay current too.
Schedule recurring reviews and track renewals
Put every vendor review on a calendar tied to contract renewal, material service changes and any incident involving the vendor. Record each review's findings, the remediation owner and the close-out date. Update the vendor register whenever a subcontractor changes. The output is a review calendar and a review log that show the relationship was managed over time. The January 2025 proposed rule would add a requirement for written verification from business associates at least once every 12 months that required technical safeguards are deployed. That change is proposed only, so treat it as a planning input rather than a current obligation, and confirm the status of the rule before relying on it.

Which evidence passes a business associate review

A business associate review tests whether a covered entity or business associate can show, for each vendor that touches ePHI, who has the data, what assurances were obtained and whether anyone checks them over time. The cards below cover the artifacts that answer those questions, and the ones an assessor will ask to see first.

Vendor inventory tied to ePHI flows

A current list of every vendor, cloud service and subcontractor that creates, receives, maintains or transmits ePHI, mapped to the data flows that carry it. A reviewer checks whether the inventory matches the risk analysis and whether any system holding ePHI is missing from it. Keep it current by tying each new integration, hosting account or support tool to a change request that updates the inventory before go-live.

Executed business associate contracts

Signed written contracts or other arrangements that meet 164.314(a), each with an execution date and a named owner on both sides. A reviewer confirms that every vendor on the inventory has one in force before ePHI flows to it. Your counsel reviews the contract text itself, but the evidence an assessor needs is the signed copy, its date and a register linking it to the vendor record.

Subcontractor assurances

Where a business associate uses subcontractors that handle ePHI, the covered entity should see the chain of assurances, since 164.308(b)(2) requires each business associate to obtain satisfactory assurances from its subcontractors. A reviewer looks for written vendor attestations listing subcontractors, and for a process that asks for updates when the vendor adds one. Ask vendors to notify you of subcontractor changes and record the date you received each notice.

Performance measurement record

Dated records showing that you measure whether each vendor meets its security obligations, such as completed questionnaires, evidence of required safeguards, reviewed audit reports and open findings with due dates. NIST SP 800-66 Rev. 2 lists measuring contract performance as a key activity for this standard. Keep a recurring entry per vendor so an assessor can see the measurement happened, not just that a template exists.

Termination criteria and terminations

Written criteria that state when a vendor's access to ePHI will be suspended or the contract ended, such as unremediated security failures or a refusal to provide assurances. A reviewer asks for the criteria and for any case where they were applied, including the decision record and the steps taken to retrieve or destroy ePHI. If no vendor has ever been terminated, the criteria still need to exist and be tested.

Review cadence and sign-off

A defined schedule for reviewing each vendor relationship, with the reviewer, the date of each review and the outcome recorded. The January 2025 proposed rule would require written verification from business associates at least once every 12 months, but that change is not final, so confirm the current requirement with counsel and set your own cadence from the risk analysis. Keep reviews on a shared calendar and store each sign-off with the vendor record.

What meeting the business associate standard costs

This table compares the main cost components of meeting 164.308(b)(1), showing who is paid for each, whether it is one-time or recurring, and what pushes it up or down. No dollar figures or durations are given because none are supported by researched facts, so treat the table as a checklist for requesting written quotes from vendors and advisers. The main takeaway is that open-source licensing reduces software spend but leaves the contract and vendor-oversight work in place.

Cost component	Who is paid or who does the work	One-time or recurring	What drives it up or down
Legal review of business associate contracts	Outside counsel or in-house legal, to confirm 164.314(a) terms are in each agreement	One-time per contract, plus recurring on renewal or amendment	Up: many vendors and bespoke terms. Down: a standard template with approved security clauses
Vendor due diligence	Security or compliance staff, sometimes with a questionnaire service	Initial review, then recurring reassessment	Up: vendors that handle large ePHI volumes or hold it offsite. Down: reusing evidence from prior reviews
Inventory and data-flow mapping	Internal IT and privacy staff, or an implementation partner preparing the register	One-time build, recurring updates as systems change	Up: many systems and undocumented integrations. Down: a single vendor register tied to system inventory
Performance review and monitoring	Internal owners of each vendor relationship	Recurring, at the frequency set by the risk analysis	Up: critical vendors and frequent changes. Down: defined service metrics and standard reporting
Subcontractor tracing	Business associates, who must obtain assurances from their own subcontractors under 164.308(b)(2)	Recurring as the subcontractor chain changes	Up: deep subcontracting chains and opaque vendors. Down: contract clauses requiring subcontractor disclosure
Contract renegotiation and termination planning	Legal counsel and procurement, with technical staff for exit steps	One-time per renegotiation, plus contingency planning	Up: vendors that refuse security terms. Down: agreeing standard terms at signing
External assessor sampling, if commissioned	Independent assessor, under a written engagement	One-time per review cycle	Up: sample size and number of vendors in scope. Down: a current register and organized evidence

Where open-source tools keep vendor evidence current

CISO Assistant is an open-source governance, risk and compliance tool (AGPL-3.0-only) that ships more than 200 frameworks, including ISO 27001, NIST CSF, SOC 2, PCI DSS, NIS2, DORA and GDPR. It can run audits and compliance assessments against those frameworks and maps requirements automatically between them. For business associate management, that means vendor assessment items can be tracked as assessment records and linked to the frameworks the organization already reports against. It supports evidence of what was assessed, when, and against which requirement.

Assessment tracking: Vendor questionnaire answers and due diligence results can be recorded as items against assessments.
Framework mapping: Automatic mapping between frameworks can show where a vendor item overlaps with other requirements the organization tracks.
Evidence attachment: Supporting documents such as signed agreements or security attestations can be linked to the item they support.
Review cycle: Assessments can be repeated so the organization can show that vendor reviews happened on a schedule.

It does not hold a HIPAA framework out of the box in the sense of a certified mapping, does not verify a vendor's safeguards, and does not produce a business associate agreement. Confirm whether HIPAA-related content is included in your installed version and validate any mapping against the Security Rule text and your own legal review before relying on it.

Business associate contract questions buyers ask before hiring help

Is a business associate agreement the same as the required written contract?

A business associate agreement is the most common way to meet the standard, but 164.308(b)(3) does not require that exact document. It requires the satisfactory assurances to be documented through a written contract or other arrangement that meets 164.314(a), so the test is content and enforceability, not the label. Your counsel should confirm that the document contains the 164.314(a) elements, covers every vendor that creates, receives, maintains or transmits ePHI for you, and reflects how the vendor actually handles the data. Ask any consultant to review your template against the rule text, and keep executed copies with the vendor inventory so an assessor can match each relationship to a signed document.

How much effort does it take to inventory vendors and subcontractors?

The effort scales with how many vendors touch ePHI and how many layers sit beneath them. The work usually includes listing every system that stores or moves ePHI, identifying each outside party with access to it, and asking each business associate to name its own subcontractors that handle ePHI. Effort rises with decentralized purchasing, shadow SaaS tools, clinical devices managed by third parties, and cloud or hosting chains that are several tiers deep. It falls when procurement already records data flows and when contracts are held in one repository. Ask any provider for a written method covering discovery, owner sign-off, and how often the inventory is refreshed.

Can we do the business associate work ourselves without outside help?

Yes, a covered entity or business associate can identify its vendors, check contracts and track assurances in-house, and the rule does not require an outside party. The harder part is consistency: someone must decide which vendors are business associates, which contract language is sufficient, and what happens when a vendor fails a security requirement. Many organizations keep this work internal and bring in help for a specific gap, such as drafting a contract template, reviewing a large inventory, or setting up a documented review cycle. Any outside firm can prepare documents and evidence, but only you own the assurances, and no third party can certify that a vendor is compliant.

What work do legal, procurement and security teams need to contribute?

Each function owns a different part of the process, and the handoffs are where most delays occur. Legal reviews and maintains the contract or arrangement language, including the 164.314(a) elements and breach obligations. Procurement adds a PHI screening step to vendor intake, collects signed documents before data flows, and keeps the contract register current. Security sets the technical assurance requirements, reviews vendor security evidence, defines what counts as a failed requirement, and works out termination steps with the business owner. Ask any outside party to show which tasks it will do and which decisions stay with your staff.

How long does a business associate contract review take?

No duration is supplied for this work, and the time depends on the number of vendors, how many already have signed agreements, and how much negotiation each one requires. A clean template with a short vendor list moves quickly, while a large portfolio with custom terms and subcontractor chains takes much longer. Ask any provider for a written scope that lists the vendors in view, the documents to be reviewed or drafted, the deliverables, the decision points that need your sign-off, and the dates agreed for each stage. Because most engagements are fixed-scope, the written scope is also the basis for the timeline.

What would the proposed 12-month verification add if it is finalized?

The January 2025 proposed rule (90 FR 898) would require covered entities to obtain written verification from business associates at least once every 12 months that required technical safeguards are deployed. It was a proposal, not a final rule, and the latest Unified Agenda lists final action as projected for July 2027, so do not treat it as current law. If finalized, it would add a recurring cycle on top of the initial contract work: requesting the verification, reviewing it, following up on gaps, and recording the result. Build your inventory and evidence store so this step could be added without rebuilding the process, and confirm the final text before you change contract terms.

Can an assessor certify that our vendors comply with HIPAA?

No. HHS states that no Security Rule standard requires certification, that it does not endorse or recognize private certifications, and that a private certification does not prevent HHS from later finding a violation. An independent assessor can test your vendor oversight process and report what it found, but that report is not a HIPAA certificate and does not transfer liability for a vendor's failure. Treat any firm that offers a HIPAA certification for vendors as a warning sign. Ask for the assessor's written scope, the criteria it tested against, and the evidence it reviewed, and keep the vendor's signed assurances and performance records as your own proof.

Who owns the vendor contracts, who prepares evidence, and who tests it

Your organization owns the vendor relationship and every decision the standard turns on. Under 45 CFR 164.308(b)(1), a covered entity may let a business associate handle ePHI only after obtaining satisfactory assurances, and that obligation stays with you even when a lawyer drafts the agreement or a consultant builds the inventory. Your team decides which vendors qualify as business associates, which contract terms are satisfactory, and whether a residual risk is acceptable.

Vendor decisions: approving or rejecting each vendor that will create, receive, maintain or transmit ePHI.
Contracts: executing the written contract or other arrangement that meets 164.314(a), with named signatories.
Performance review: checking whether vendors keep the security requirements in the contract, on a schedule you set.
Termination: deciding when a vendor that fails those requirements must be remediated or removed.
Risk acceptance: signing off on any exception and recording why it is acceptable.

Ask whether a named owner can produce the signed contract, the last review and the open exceptions for every business associate on request.

How DeployOpen scopes and prepares business associate evidence

DeployOpen works on the technical and documentary side of 164.308(b)(1) business associate arrangements for organizations that run self-hosted open-source platforms holding ePHI. We prepare systems, configurations and evidence that support the written contract or other arrangement, while the organization and its legal counsel own the contract terms and the independent assessor owns any report.

How we scope

Engagements are fixed-scope, with the list of vendors, subcontractors and ePHI flows agreed in writing before work starts.
The written scope names which platforms and data paths need documented satisfactory assurances under 164.314(a).
Scope also states what DeployOpen will not do, including drafting legal terms or issuing any attestation of compliance.

How we build

We map each business associate and subcontractor relationship to the systems that create, receive, maintain or transmit ePHI.
We configure access, logging and contract-performance records so the organization can measure vendor security obligations over time.
We document the termination triggers and the process for ending a vendor relationship when security requirements are not met.

How we hand over

Deliverables include a written register of business associate relationships, the evidence index and the configuration records behind it.
Documentation is delivered in formats the organization can keep under its own version control and update after changes.
The organization receives the list of open items and owners so its security official can confirm the arrangements are maintained.

How we support

Ongoing support and continuous testing are available as retainers for keeping vendor registers and evidence current.
Support can cover periodic review of business associate evidence after platform upgrades or new vendor onboarding.
Confirm with your own counsel and with the independent assessor which evidence each reviewer will accept before the engagement begins.

164.308(b)(1) Business associate contracts and other arrangements