Business associate agreements: what the Security Rule requires and who must sign
A customer, auditor or contract now asks for a business associate agreement (BAA), and the Security Rule is the reason. A covered entity may let a business associate create, receive, maintain or transmit electronic protected health information only after obtaining satisfactory assurances in a written contract or other arrangement (45 CFR 164.308(b))). For the Security Rule, that contract must require the business associate to comply with Subpart C, flow the same requirements down to subcontractors, and report security incidents, including breaches of unsecured PHI, to the covered entity (45 CFR 164.314(a))). The contract is a precondition for handling ePHI, not paperwork that follows it. The actual terms vary with the services, the subcontractor chain and the data flows. A vendor that hosts ePHI in its own environment needs a different set of commitments than one that only transmits it. OCR's cloud guidance says a BAA is still required when a cloud provider stores only encrypted ePHI without holding the key, and that the provider's service level terms must be consistent with the agreement and must not block the customer's access to its ePHI. Ask whether the vendor's subcontractors (hosting, support, backup, logging) are covered by compliant flow-down contracts, and whether the incident reporting clause matches the timing and detail your own incident response plan needs. The organization owns the contract and the controls it describes. Counsel should draft or review the terms, and the security team should confirm that each commitment can be tested, such as which logs the vendor will share and how safeguards are evidenced. No independent body certifies a BAA, and a signed agreement does not show that the vendor's safeguards work. Keep executed agreements for six years from creation or last effective date (45 CFR 164.316(b)(2)(i)). The January 2025 proposed rule would add annual written verification of business associates' technical safeguards and 24-hour notice when a contingency plan is activated, but as of October 2026 those changes are proposals, so confirm the current text with counsel.
What a Security Rule BAA must contain
The Security Rule sets a short list of clauses that every business associate agreement must carry for electronic PHI. Each card below covers one clause, what it obligates the business associate to do, and what a covered entity or business associate should check before signing. Confirm the full list against the eCFR text and with counsel before relying on it.
Compliance with Subpart C
The contract must require the business associate to comply with the Security Rule's administrative, physical and technical safeguards for the ePHI it handles. This makes the Security Rule a contractual duty, not only a regulatory one. Check that the clause names the Security Rule and covers every system where ePHI is created, received, maintained or transmitted, not only the production environment.
Flow-down to subcontractors
The business associate must bind every subcontractor that handles ePHI for it to a compliant written contract with the same Security Rule requirements. Business associates are directly liable for failing to sign these agreements and for failing to address a material breach by a subcontractor. Ask for a current subcontractor list and confirm each downstream contract contains the flow-down terms.
Reporting security incidents
The contract must require the business associate to report security incidents to the covered entity, including breaches of unsecured PHI. The clause should set the reporting trigger, the channel and the content of the report, so the covered entity can meet its own notification duties. Confirm the agreed timing with the business associate in writing, since the rule does not fix a single number of hours in this clause.
Satisfactory assurances before access
A covered entity may allow a business associate to handle ePHI only after receiving satisfactory assurances documented in a written contract or other arrangement. Government entities may use another arrangement that meets the privacy rule's requirements in place of a contract. Before any data moves, confirm the signed agreement exists and is dated before the first ePHI transfer.
Six-year retention of the agreement
The agreement itself is documentation that must be kept for six years from its creation or last effective date, under 45 CFR 164.316(b)(2)(i). Retention applies even after the vendor relationship ends, so the covered entity needs a copy it can produce for an OCR request. Ask both parties to set an archive owner and to store the signed version, amendments and termination notice together.
How the incident reporting clause works in practice
The clause turns a subcontractor's security event into a documented chain of notices, so the covered entity learns of the incident from its business associate and can decide what to report. Each link should leave a record that an assessor or OCR investigator could follow from start to finish.
Detect and log the suspected incident
The subcontractor's security team or monitoring tools flag an event that may affect ePHI, such as unusual access, malware on a system that holds PHI, or a misdirected file. The responder opens a ticket, records the time of discovery, the systems and data involved, and who was notified internally. The output is an incident record with a unique identifier, which every later step cites. Confirm that your subcontractor's logging is retained long enough to reconstruct the timeline.
Triage whether ePHI was involved
The subcontractor determines whether the event touched electronic protected health information and whether it is a security incident under the Security Rule's definition or only an event that never reached ePHI. Responders check access logs, encryption status and data flows for the affected systems. The output is a written triage note stating what was ruled in or out and the evidence behind that decision. Ask counsel to confirm how your contract defines security incident and whether it covers attempts as well as successful events.
Notify the business associate under the contract
The subcontractor sends notice to the business associate using the method and contact named in its subcontract, which must flow down the same reporting duty. The notice describes what is known, what is not yet known and the containment steps taken. The output is a dated notice on file at both organizations. Confirm the notice timing in your contract and in the breach notification rules with counsel, since this guide does not set a deadline.
Assess the incident and determine breach status
The business associate reviews the subcontractor's findings, contains the event, and works out whether the incident involves unsecured PHI and whether a breach is presumed under the breach notification rules. This includes a documented risk assessment that weighs the nature of the PHI, the unauthorized person involved, whether PHI was actually acquired or viewed, and mitigation. The output is an assessment memo signed by the business associate's security or privacy lead. Where the rules call for a four-factor assessment, the memo must address each factor.
Report the incident to the covered entity
The business associate sends the covered entity a written report under the reporting clause in the business associate agreement. The report identifies affected individuals where known, the PHI involved, the actions taken and the remediation plan, and it carries the subcontractor's incident identifier so the chain stays traceable. The output is the covered entity's receipt of the report and a logged acknowledgment. If the report is incomplete, the business associate should say what is still open and when it will update the covered entity.
Decide notifications and document the outcome
The covered entity reviews the report and decides what notifications the breach notification rules require, including to individuals, the media and HHS where they apply. The covered entity keeps the business associate's report, its own assessment and the notices it sent. The output is a closed incident file that can be produced to OCR. Retain documentation for six years, as the Security Rule requires for documentation generally, and confirm the retention and notification steps with counsel.
Review the root cause and update controls
After containment, the subcontractor and business associate run a root cause review and update the risk analysis, risk management plan and any affected safeguards or subcontract terms. Lessons are fed back into vendor assessments and training. The output is a corrective action record with owners and completion dates, plus an updated risk analysis entry. This closes the loop that OCR investigators look for when they ask how an organization responded to an incident.
How BAAs differ for vendors, subcontractors and government entities
A commercial business associate creates, receives, maintains or transmits ePHI on behalf of a covered entity, such as a billing company, a transcription service or a managed IT provider. Before it touches ePHI, the covered entity must obtain satisfactory assurances in a written contract, and the business associate must meet the Security Rule as if it were a covered entity. The contract must require compliance with Subpart C, subcontractor flow-down and reporting of security incidents, including breaches of unsecured PHI.
- Subpart C compliance: The contract should require the vendor to comply with the Security Rule, not just to "protect PHI" in general terms.
- Incident reporting clause: Check the notification timing and the scope of reportable security incidents against your own incident response plan.
- Return or destruction: Confirm what happens to ePHI at termination and who pays for data export.
- Access to records: Confirm the covered entity can obtain the vendor's policies and risk analysis when needed.
- Documented retention: The agreement must be kept for six years from creation or last effective date.
Check that the BAA was signed before the first ePHI transfer, not after the service started.
A business associate that hands ePHI to a subcontractor creates a second link in the chain, and the subcontractor takes on the same obligations as the business associate that engaged it. The business associate must obtain satisfactory assurances from each subcontractor that handles ePHI for it. Business associates are directly liable under HHS's direct liability guidance for failing to enter into these agreements and for failing to address a material breach by a subcontractor.
- Written flow-down: Each subcontractor agreement must carry the same Security Rule requirements down the chain.
- Subcontractor inventory: Ask for a current list of every subcontractor that can reach ePHI, including hosting and support tools.
- Breach response: Confirm the business associate has a defined process for acting on a subcontractor's material breach.
- Incident reporting: Subcontractor incidents must still reach the covered entity through the business associate's reporting duty.
- Change notice: Ask how the business associate tells you when it adds a new subcontractor.
Check the chain of contracts end to end, because a missing link at the bottom invalidates the assurances above it.
A cloud or hosting provider may store ePHI that it cannot read, for example when the customer holds the encryption keys. OCR's cloud guidance is clear that a business associate agreement is still required in this case, because the provider maintains ePHI even without access to the key. Service level terms also matter: they must be consistent with the agreement and must not block the customer's access to its own ePHI.
- BAA despite encryption: A provider cannot rely on "we cannot see the data" to avoid signing.
- Key custody: Document who holds the keys, how they are stored and how they are rotated.
- SLA consistency: Review suspension, throttling and account termination terms for anything that could block access to ePHI.
- Data export: Confirm the customer can retrieve complete copies of its data in a usable format.
- Shared responsibility: Map which safeguards the provider operates and which the customer must run, and write that split into the contract or its attachments.
Check that the provider's standard BAA covers the specific services you use, not only the platform in general.
A government entity that acts as a business associate may use an arrangement other than a contract, provided that arrangement meets the requirements of 45 CFR 164.504(e)(3). This allows interagency agreements, memoranda of understanding or statutory mandates to satisfy the assurance requirement in place of a standard commercial agreement. The substance of the Security Rule obligations still applies, so the arrangement must actually cover the same ground.
- Substance over form: Confirm the alternative arrangement addresses Subpart C compliance, subcontractor flow-down and incident reporting.
- Statutory basis: Identify the law or governing document that creates the obligation and where it is recorded.
- Termination and return: Check how ePHI is returned or destroyed when the arrangement ends.
- Named contacts: Confirm who receives incident notices on each side.
- Retention: Documentation of the arrangement must still be kept for six years.
Check with the government entity's counsel whether its arrangement meets the 164.504(e)(3) standard before relying on it.
Why SLA terms must not block access to ePHI
OCR's cloud guidance treats the business associate agreement as the controlling document for ePHI, and service level terms must fit inside it. The cards below cover the terms a buyer should review so that uptime promises, data handling and exit provisions do not restrict the covered entity's access to its own data.
Consistency between SLA and BAA
Check whether the SLA contains terms that conflict with the business associate agreement, such as broader rights to use or disclose data, or shorter incident reporting windows. Where the two documents disagree, the buyer needs to know which one governs. Ask the vendor to confirm the order of precedence in writing before signing.
Access to ePHI during outages
OCR's cloud guidance says SLA terms must not block the customer's access to its ePHI. Review whether service credits, suspension rights or account holds could prevent the covered entity from reaching its records during a dispute or a payment problem. A clause that lets the vendor lock access for non-payment needs particular scrutiny.
Encrypted data without the key
OCR's cloud guidance states that a business associate agreement must be in place even when the provider stores only encrypted ePHI and holds no key. Confirm that the SLA does not treat encrypted storage as outside the agreement, and that key custody and recovery terms are described in the contract itself.
Data return on termination
Read the exit provisions to see how and when ePHI is returned to the covered entity, in what format, and within what period. Confirm whether the vendor will provide an export before account deletion and whether deletion certificates are issued. Ambiguous exit language is a common source of access disputes at contract end.
Subcontractor and hosting changes
Check whether the SLA allows the vendor to move ePHI to new hosting locations or subcontractors without notice. Each change should flow down the same safeguards required by the business associate agreement. Ask for notice terms and a right to object or terminate if a subcontractor no longer meets the assurances.
Retention and documentation terms
Confirm that the vendor's retention periods for logs, backups and deleted data align with the documentation retention that applies to business associate agreements, which HIPAA sets at six years from creation or last effective date. Ask the vendor to show how audit records and agreements are kept and retrieved during an OCR inquiry.
What the 2025 proposal would change for business associates
The January 6, 2025 proposed rule (90 FR 898, RIN 0945-AA22) would add two duties that reach business associates directly. The first is annual written verification that each business associate has deployed the technical safeguards the covered entity relies on, so the covered entity would need a documented, repeatable way to obtain that proof each year rather than a one-time attestation at signing. The second is notice within 24 hours when a business associate activates its contingency plan, which would move incident awareness from the end of a recovery to its start. As of October 2026 these are proposals only. No final rule has been published, and the latest Unified Agenda entry lists the rulemaking under Long-Term Actions with final action projected for July 2027. Neither timeline is a commitment, and the final text may differ from the proposal.
Covered entities and business associates should treat the proposal as a planning input, not a current obligation. Current contracts must still meet the 45 CFR 164.314(a) requirements, and nothing in the existing rule requires a 24-hour notice or annual verification. Before renewing or amending agreements, confirm the proposed terms against the proposal text and the Unified Agenda entry for RIN 0945-AA22, then check whether your current business associates could produce annual evidence of encryption, access control and logging if asked, and which of them could meet a 24-hour notice window from their contingency plan activation.
The practical step is to draft contracts that can be amended without renegotiating from scratch. Include a clause that lets either party update the security schedule when federal requirements change, a defined evidence package the vendor will provide on request each year, and a notification timeline for contingency plan activation that you can tighten later. Ask vendors to confirm in writing who would own the verification work and what it would cost them, since those costs will shape pricing at renewal. Record these decisions in your six-year documentation so you can show how the agreement reflects your risk analysis at the time it was signed.
Common BAA gaps that delay vendor onboarding
Most delays in vendor onboarding come from a short list of gaps in the business associate agreement and the contracts around it. Each card below names one gap and the check to run before the covered entity approves the vendor, so the contract review can finish in one pass.
No BAA with cloud or hosting providers
Teams often assume a cloud host that stores only encrypted data is outside HIPAA. OCR's cloud guidance says a business associate agreement must still be in place even when the provider holds ePHI without the encryption key. Check that the cloud or hosting provider has signed a BAA covering the specific services that store, process or transmit ePHI, and confirm the service list in the BAA matches the services in use.
Subcontractors without flow-down
A business associate must obtain satisfactory assurances from any subcontractor that handles ePHI on its behalf, and those assurances must be in a compliant contract. Ask the vendor for a current list of subcontractors that touch ePHI and for copies or confirmation of their agreements. A gap here can make the business associate directly liable for failing to enter those agreements.
Missing security incident reporting terms
The contract must require the business associate to report security incidents, including breaches of unsecured PHI, to the covered entity. Many vendor templates describe breach notice only in general terms and omit security incidents that did not become breaches. Check that the BAA sets a notice obligation, names who receives it, and does not leave the timing to the vendor's discretion.
Undocumented retention of agreements
Business associate agreements are documentation that must be kept for six years from the date of creation or the last effective date. Vendors and covered entities both need to know where the signed copy lives and who can produce it during an OCR review. Confirm that both parties hold a signed, dated version and that renewals or amendments replace the earlier version in the file.
SLA terms that conflict with the BAA
Service level agreements often contain restrictions on data access, suspension for nonpayment, or limits on how quickly data is returned. OCR's cloud guidance says SLA terms must be consistent with the BAA and must not block the customer's access to its ePHI. Read the SLA beside the BAA, look for conflicting access, termination and data return terms, and ask the vendor to confirm in writing which document controls.
Unclear scope of Security Rule compliance
A BAA must require the business associate to comply with the Security Rule, not only to keep PHI confidential. Some agreements cite the Privacy Rule alone or describe safeguards in vague terms. Check that the contract names Subpart C of the Security Rule as a compliance obligation and that the vendor can describe the safeguards it uses to meet it, rather than relying on a general statement of care.
Who owns the BAA, who drafts it and who verifies it
The organization that holds or sends ePHI owns the business associate agreement and the decision to share ePHI with a vendor. Under 45 CFR 164.308(b), a covered entity may let a business associate create, receive, maintain or transmit ePHI only after it has obtained satisfactory assurances in a written contract or other arrangement. Those assurances are the organization's to obtain and retain, so the signature and the file belong to the organization, not to any consultant it hires.
- Decision to disclose: Confirm which systems and data flows a vendor will touch before signing, since the contract scope follows the data.
- Signature authority: The organization's authorized officer signs the agreement and approves each subcontractor flow-down.
- Record keeping: Retain the agreement for six years from creation or last effective date under 45 CFR 164.316(b)(2)(i).
- Vendor inventory: Maintain a current list of business associates and the ePHI each one handles.
- Monitoring: Schedule periodic review of vendor safeguards and incident reports.
Before signing, check that the agreement names the systems in scope and that someone inside the organization can show who approved it and when.
Legal counsel drafts and negotiates the agreement's terms, including indemnities, liability caps, incident notice periods and termination rights. Counsel translates the Security Rule's required contract elements into enforceable language, and reviews how the vendor's standard terms, service level agreements and cloud terms fit with the BAA. Counsel does not supply the technical facts that the contract describes, so their draft is only as accurate as the scope and controls the vendor confirms.
- Required elements: Confirm the draft requires compliance with Subpart C, flow-down to subcontractors, and reporting of security incidents under 45 CFR 164.314(a)(2)(i).
- Conflicting terms: Check that the vendor's service level agreement does not limit the customer's access to its ePHI, as OCR's cloud guidance warns.
- Subcontractors: Require the vendor to name or describe subcontractors that touch ePHI and to bind them by compliant contracts.
- Termination and return: Specify how ePHI is returned or destroyed at the end of the relationship.
- Government entities: Where a government body is involved, confirm whether the arrangement meets 45 CFR 164.504(e)(3) instead of a standard contract.
Ask counsel to confirm in writing which clauses reference the current rule and how the agreement will change if the proposed 2025 Security Rule is finalized.
An implementation partner such as DeployOpen prepares the technical evidence and vendor assurance records that a BAA depends on. For self-hosted open-source platforms running in the client's own cloud accounts, data centers or air-gapped networks, the partner can document how safeguards are configured, collect logs and configuration records, and organize vendor assurance files. The partner does not sign the agreement, does not give legal assurance to the covered entity, and does not certify compliance.
- Technical evidence: Prepare configuration baselines, access records, encryption settings and backup procedures that the organization can show to a reviewer.
- Vendor assurance records: Organize the questionnaires, attestations and contract files the organization collects from its own vendors.
- Subcontractor mapping: Document which hosting, support and tooling providers touch ePHI.
- Incident readiness: Set up logging and runbooks that let the organization meet its reporting clause.
- Scope limits: Confirm in the written scope that the partner prepares records and does not sign, attest or certify.
Ask for the written scope to list every evidence item and its owner, so that the organization knows which records it must maintain itself.
An independent assessor tests controls when an organization engages one and issues any report. Assessors are separate from the parties who draft or prepare the contract and the evidence. HHS states that it does not endorse or recognize private certifications, and no Security Rule standard requires an entity to certify compliance, so a third-party report is a voluntary input to the organization's own assurance, not a legal substitute for the BAA.
- Scope of testing: Agree in writing which systems, vendors and BAA obligations the assessor will test.
- Evidence sampling: Expect the assessor to request the signed agreements, subcontractor records and incident logs for the sampled vendors.
- Report type: Confirm what the assessor will issue, and what the report does and does not cover.
- Independence: Confirm that the assessor is not the same firm that drafted the BAA or built the controls it tests.
- Cost drivers: Fees depend on scope and sample size, so request a quote that itemizes them.
Before engaging an assessor, ask for a sample report and confirm it does not state that the organization is HIPAA certified.
Business associate agreement questions buyers ask
Do we need a business associate agreement if the vendor only stores encrypted data?
Yes, in most cases the agreement is still required. OCR's cloud guidance says a business associate agreement must be in place even when a cloud provider stores only encrypted ePHI and holds no key. The reason is that the provider still maintains ePHI on your behalf, and 45 CFR 164.308(b) requires satisfactory assurances before a business associate may create, receive, maintain or transmit ePHI. Encryption reduces risk and may affect breach analysis, but it does not remove the contract requirement. Ask counsel to confirm how the vendor's role fits the definition in your specific arrangement, and check that the vendor's service level terms do not limit your access to your own ePHI.
What does a business associate agreement cost, and who pays for it?
No public fee schedule exists, and the cost depends mostly on how much negotiation the contract needs. The covered entity typically pays its own counsel to review or draft the agreement and to negotiate its terms. The vendor pays its own counsel for its side. Costs rise when both parties use custom language, when the vendor has a standard form that departs from the Security Rule terms, or when subcontractor flow-down clauses must be reviewed. Costs fall when both sides accept a standard template that covers the required Security Rule terms. Ask your counsel for a fixed or capped estimate based on the number of vendors, the contract types and the expected rounds of negotiation. Most of the work is one-time, though renewals, new services and amendments recur.
How long does it take to review and sign a business associate agreement?
The time depends on the scope of the services, the number of parties involved and whether the vendor accepts a standard form. A simple agreement with a vendor that uses a familiar template can move quickly, while a complex arrangement with subcontractors, custom security commitments and multiple reviewers takes longer. Delays usually come from the vendor's legal review, disputes over incident reporting timelines and subcontractor disclosures. Because timelines vary this much, confirm the expected schedule with your counsel and the vendor before you commit a go-live date that depends on the agreement. Build the review into your vendor onboarding plan so that no ePHI moves until the agreement is signed.
Can our team draft its own business associate agreement?
Yes, a covered entity or business associate may write its own agreement, provided it contains the terms the Security Rule requires. Under 45 CFR 164.314(a)(2)(i), the contract must require the business associate to comply with Subpart C, flow the same requirements down to subcontractors and report security incidents, including breaches of unsecured PHI, to the covered entity. The agreement must also meet the Privacy Rule terms in 45 CFR 164.504(e). Teams that draft internally often reuse a template and then miss subcontractor or incident reporting language. Have legal counsel with HIPAA experience review the final text. DeployOpen does not draft or issue legal agreements; its role is to help prepare the technical systems and evidence that the contract terms describe.
How long must we keep business associate agreements?
Keep each business associate agreement for six years from the date it was created or from the date it last took effect, whichever is later. This retention period comes from 45 CFR 164.316(b)(2)(i), which applies to the documentation the Security Rule requires. Keep superseded versions and amendments as well, so you can show which terms applied at any given time. Store the agreements where authorized staff can retrieve them during an OCR investigation or a vendor dispute. Confirm with counsel whether other state or contractual retention rules apply to the same records, since those may require a longer period.
What should a business associate agreement say about incident reporting?
The agreement should require the business associate to report security incidents, including breaches of unsecured PHI, to the covered entity. The Security Rule ties this duty to 45 CFR 164.314(a)(2)(i), but it does not set a specific number of hours. Ask counsel to define what counts as a reportable incident, who receives the report and what information must be included. Confirm that the same duty applies to the vendor's subcontractors. The January 2025 proposed rule would add a 24-hour notice when a business associate activates its contingency plan, but that change is proposed only and is not in force. Check the current status before you rely on it.
Are business associates directly liable under HIPAA?
Yes, business associates can be directly liable for some HIPAA failures, so the agreement does not shift all responsibility to the vendor. HHS states that business associates are directly liable for failing to enter into agreements with subcontractors that create or receive PHI for them, and for failing to address a material breach of a subcontractor's agreement. Covered entities remain responsible for choosing vendors that provide satisfactory assurances and for acting on known contract violations. Use the agreement to define responsibilities clearly, then verify them through vendor documentation and periodic review.
How DeployOpen prepares the technical evidence behind a BAA
DeployOpen does not write or sign a business associate agreement, and it does not issue reports or certificates. What it can do is prepare the technical evidence that a covered entity or business associate needs to back up the assurances in its BAA. Every engagement starts with a written scope that names the platforms, hosting environments, data flows and parties in play, and that scope is agreed before work begins. A quote follows from that written scope, so the cost reflects the systems and subcontractors actually in view rather than a standard package. If legal terms are part of the work, counsel for the organization drafts and negotiates them. DeployOpen only reviews the technical statements those terms depend on.
Inside that scope, the work begins with a map of every system that creates, receives, maintains or transmits ePHI, including the hosting provider, backup targets, logging pipelines, support tools and any subcontractor with access to those systems. The map is cross-checked against the list of subcontractors the organization has bound by compliant agreements under 45 CFR 164.308(b)(2). Where a gap appears, such as a hosting provider without a signed agreement or a support tool with standing administrative access, the gap is recorded in the engagement log so the organization can decide how to close it. DeployOpen then prepares the technical safeguard evidence that supports the contract terms, including encryption configurations, access control settings, audit log retention, and the records of vendor reviews. Each item is tied to the specific clause it supports, so an assessor or customer can trace a promise to a setting.
The handover is a documentation set the organization owns and can give to auditors, customers or counsel. It typically covers the system inventory, the subcontractor register, configuration baselines, test results, and a log of open items with owners and dates. Before handover, the organization should confirm three things in writing: who is responsible for keeping the vendor assurance records current, which events trigger an update, and how the incident reporting path in the BAA maps to the actual alerting and escalation steps in the environment. Ask the team to walk through a simulated incident against the register. The gap between what the contract says and what the systems do is usually where the next finding will come from.
