HIPAA subcontractor agreements and flow-down terms

Do HIPAA subcontractor agreements apply to our vendors, and what must they say?

Yes, if a vendor of yours handles ePHI on your behalf, it needs a written agreement with you, and you, not the covered entity, are the party who must obtain it. Under 45 CFR 164.308(b)(2), a business associate must obtain satisfactory assurances from any subcontractor that creates, receives, maintains or transmits electronic protected health information for it. The covered entity does not collect those assurances from your subcontractors, so the gap sits with you if the paperwork is missing. Start by listing every cloud host, billing platform, support desk, backup provider and offshore engineering firm that can reach ePHI, including data you only store encrypted, and confirm each one has a signed agreement.

The required terms depend on what the subcontractor does and which data it touches. Under 45 CFR 164.314(a)(2)(i), the contract must require the subcontractor to comply with the Security Rule's Subpart C, flow the same requirements down to any of its own subcontractors through compliant contracts, and report security incidents, including breaches of unsecured PHI, to you. A subcontractor that only hosts infrastructure needs different safeguard commitments than one that edits claims or runs remote support sessions, so the scope of the agreement should follow the systems and access each vendor actually has. Ask each subcontractor for the specific systems, data stores and administrator accounts in scope, and write those into the agreement rather than relying on a generic template.

Your own liability does not end at the contract. The HHS direct liability guidance states that a business associate is directly liable for failing to enter into agreements with subcontractors that create or receive PHI for it, and for failing to address a material breach by a subcontractor once it knows of a pattern of that breach. Before you sign, confirm that each subcontractor agreement contains a reporting duty you can act on, a right to review its safeguards, and a termination path. Keep a register of agreements with dates and scope, and reconcile it against your data flows at least when a vendor changes its service. Because the proposed Security Rule changes are not final, treat the current text as the operative standard.

How to get satisfactory assurances from each subcontractor

This sequence moves a business associate from knowing which vendors touch ePHI to holding signed, compliant subcontractor agreements and a record of ongoing oversight. Each step produces a document a regulator or assessor can inspect.

Inventory every vendor that touches ePHI
Start with a complete list of the third parties your organization uses to create, receive, maintain or transmit ePHI on your behalf. Include hosting, backup, email, support tools, offshore support, and any service that can see data in clear text or in encrypted form where a key is held. Owner: the security official with operations and procurement. Output: a vendor register listing each service, the data it touches, where that data is stored, and the named business contact. Confirm the register against access logs and invoices, since shadow tools often surface only there.
Classify each vendor as a subcontractor
For each entry, decide whether the vendor creates, receives, maintains or transmits PHI for you, which makes it a subcontractor business associate under the definition in 45 CFR 160.103. Vendors that merely sell generic software with no access to PHI are usually outside this category, but document the reasoning rather than assuming it. Ask the vendor in writing how it accesses or stores data for your services. Output: a classification column in the register, with a short rationale and the name of the person who approved it.
Confirm the covered entity's agreement permits subcontracting
Before you sign anything with a subcontractor, review your own agreement with the covered entity or upstream business associate. Check whether it allows PHI to go to subcontractors, whether it requires prior notice or consent, and whether it names approved vendors. The Security Rule obligations flow through that contract, so a subcontractor arrangement that breaches the upstream terms creates exposure even if the downstream paperwork is complete. Output: a written note confirming permitted subcontracting, or a request to the covered entity for consent that is filed with the register.
Execute a written subcontractor agreement
Put each subcontractor relationship into a written agreement that meets the same requirements as the business associate agreement a covered entity would require from you. HHS states that the business associate itself must obtain these satisfactory assurances, and the Security Rule requires them under 45 CFR 164.308(b)(2). Have counsel draft or review the template once, then negotiate the individual terms for each vendor. Output: a countersigned agreement for each subcontractor that handles ePHI, stored with the register and cross-referenced to the upstream contract.
Confirm the Security Rule terms in each contract
Check each signed agreement against the Security Rule terms in 45 CFR 164.314(a)(2)(i). The subcontractor must agree to comply with Subpart C of Part 164 for ePHI, flow the same requirements down to its own subcontractors through compliant contracts, and report security incidents, including breaches of unsecured PHI, to you. Mark any clause that is missing, vague or limited to a list of controls without a compliance commitment. Output: a clause checklist for each agreement, with gaps logged and a dated remediation request sent to the subcontractor.
Gather evidence of the subcontractor's safeguards
A signed contract is not evidence that the subcontractor protects ePHI. Request the material that shows its safeguards, such as its own risk analysis summary, encryption and access control descriptions, incident response contact, and how it handles ePHI return or destruction at termination. Review the evidence against the scope of the services and record any gaps that need compensating controls. Output: a dated assessment file per subcontractor with the evidence received, the reviewer, and the decision to accept, condition or stop the relationship. Certificates alone do not close this step.
Monitor and act on subcontractor breaches
Set a recurring review of each subcontractor relationship, triggered by contract renewal, service changes, reported incidents and any change in the subcontractor's own subcontractors. Under the direct liability rules, if you know of a pattern of activity by a subcontractor that materially breaches its agreement, you must take reasonable steps to cure the problem or, if those fail and termination is feasible, end the arrangement. Output: a monitoring log with review dates, findings, cure requests, and the record of any termination or re-papering, kept with the register.

Which contract terms must flow down to subcontractors

The Security Rule sets a short list of terms that a business associate's subcontractor agreement must carry. Other terms are standard practice in negotiated agreements but are not quoted from the rule. Confirm exact wording with counsel before signing any subcontractor agreement.

Compliance with Subpart C

The subcontractor agreement must require the subcontractor to comply with the Security Rule for any electronic PHI it creates, receives, maintains or transmits for the business associate. The clause should name Subpart C of 45 CFR Part 164 so the obligation is tied to the regulation rather than to a general promise of security. Check that the scope covers every system and service the subcontractor uses for that data, including hosted tools.

Flow-down to further subcontractors

The same requirements must pass down to any subcontractor of the subcontractor through compliant contracts. Without this clause, a sub-subcontractor holding ePHI can sit outside the chain of assurances. Ask each subcontractor to list the parties it uses for PHI and confirm that each has a written agreement meeting the same standard.

Reporting of security incidents

The subcontractor must report security incidents to the business associate, including breaches of unsecured PHI. Reporting timelines and the content of each report should be stated in the contract, since the covered entity's own notice clock depends on how quickly the information arrives. Confirm that the clause covers ransomware, lost devices and misdirected transmissions, not only confirmed intrusions.

Permitted uses and disclosures

Commonly negotiated: the agreement limits how the subcontractor may use and disclose PHI to the purposes the business associate is permitted to pursue. This term is not quoted from the Security Rule, but it is the companion to the privacy-side agreement and is usually checked by the covered entity during vendor review. Confirm that the permitted purposes match the services in the statement of work.

Return or destruction at termination

Commonly negotiated: on termination, the subcontractor returns or destroys all PHI it holds, and states in writing when it cannot do so feasibly. The clause should cover backups, archives and copies held by the subcontractor's own vendors. Ask how destruction is verified, such as a written certificate, and whether data retention for legal holds is addressed.

Access to records and termination rights

Commonly negotiated: the subcontractor makes its internal practices, books and records available to HHS for determining compliance, and the business associate may terminate the agreement if the subcontractor commits a material breach. These rights matter because direct liability can arise if a business associate knows of a pattern of material breach and fails to act. Confirm that the termination clause can be exercised without an unreasonable cost to the business associate.

Where liability sits when a subcontractor breaches

A business associate carries its own liability for its subcontractors, and a covered entity's contract with that business associate does not move this exposure elsewhere. The HHS fact sheet on direct liability of business associates sets out two failure points. The first is failing to enter into a written agreement with any subcontractor that creates, receives, maintains or transmits PHI for it. The second is failing to address a material breach of a subcontractor's agreement once the business associate learns of it. In both cases, OCR can pursue the business associate directly, whether or not the covered entity knew about the subcontractor.

The second failure point turns on a pattern-of-activity test. A business associate becomes directly liable if it knew of a pattern of activity by a subcontractor that materially breached the subcontractor's agreement, and it did not take reasonable steps to cure the breach. If those steps fail, the business associate must terminate the arrangement where feasible. Knowledge is the trigger, so the practical question for a business associate is what it would find if it looked. Ask whether it reviews subcontractor security reports, incident notices and access logs often enough to notice a recurring problem, and whether it has written steps for escalation and termination that a manager could follow without legal advice.

Covered entities should treat this as a check on their own vendor files. Confirm that each business associate can name its subcontractors that touch ePHI, produce the written agreements with them, and describe how it monitors them. Ask who on the business associate side owns cure-or-terminate decisions and how quickly those decisions are made. Confirm the feasibility of termination in practice, including whether a replacement subcontractor or data migration path exists. A signed business associate agreement is evidence of the covered entity's own diligence, but it does not show that the business associate has met its duties in the chain below it.

Who owns the agreement, the controls and the evidence

The business associate owns the agreement with each subcontractor that creates, receives, maintains or transmits ePHI on its behalf. Under 45 CFR 164.308(b)(2), it must obtain satisfactory assurances from that subcontractor, and under 45 CFR 164.314(a)(2)(i) those assurances must be written and must carry the same Security Rule requirements down the chain. The covered entity does not sign these agreements and is not the party that checks them, so the business associate carries the paperwork and the follow-up.

Written subcontractor agreements: Confirm that every subcontractor with ePHI access has a signed agreement that requires compliance with Subpart C and reporting of security incidents.
Flow-down review: Check that the subcontractor terms match the business associate's own obligations to the covered entity, including incident reporting timelines.
Monitoring and cure: Track subcontractor performance, and act on a known pattern of material breach by cure, or by termination where feasible.
Inventory of subcontractors: Keep a current list of which subcontractors touch ePHI, so no vendor is missed when the chain changes.

Ask for a copy of the subcontractor inventory and the signed agreement templates before relying on the business associate's assurances.

What the MedEvolve case shows about a missing subcontractor agreement

The MedEvolve resolution shows how a missing subcontractor agreement can sit inside a business associate's own exposure. In 2023, MedEvolve, a business associate providing practice management and revenue cycle software, paid $350,000 to OCR after an FTP server holding PHI of 230,572 individuals at two covered entities was accessible from the Internet. OCR also cited the company's failure to enter a business associate agreement with a subcontractor. The two findings are separate, but they point at the same question: did the vendor know where its PHI went and who was responsible for protecting it there? The MedEvolve resolution agreement and corrective action plan is the primary document to read for the exact findings and the corrective obligations imposed.

Inference, not an OCR finding: a business associate that cannot list its subcontractors cannot prove it has an agreement with each one. Start with a data flow inventory that records every system, transfer and support path that touches ePHI, including file transfer servers, backup vendors, offshore support teams and software hosts. Match each entry to a signed subcontractor agreement that carries the Subpart C obligations and the incident reporting duty under 45 CFR 164.314(a)(2)(i). Where an entry has no agreement, treat it as an open finding and decide whether to pause the flow, sign the agreement or end the arrangement. Confirm with counsel what your current subcontractor template actually says, since a template that predates the Security Rule terms is a common gap.

Monitoring matters as much as the initial paperwork. Inference, not an OCR finding: the exposed file server in this case is the kind of asset that a periodic external scan of your own and your subcontractors' public addresses would flag, and the vendor's own risk analysis should treat any such server as in scope. Ask each subcontractor for a current list of the systems it uses for your PHI, its most recent external test results, and its incident notification contact. Record the review date and the owner for each subcontractor. Where a subcontractor shows a pattern of material breach, the direct liability rule in the HHS fact sheet on business associates applies to you, so set a documented escalation path that ends in termination where it is feasible.

Mistakes that leave a flow-down gap

Most flow-down failures are not caused by missing paperwork alone. They come from assumptions about who owns the obligation, which vendors count, and when the contract was signed relative to the data movement. Each card names one gap and the check that closes it.

Waiting for the covered entity to act

Some business associates assume the covered entity will collect assurances from the vendors they use. The Security Rule places that duty on the business associate itself. Under 45 CFR 164.308(b)(2), the business associate must obtain satisfactory assurances from any subcontractor that handles ePHI on its behalf. Check that your business associate, not the covered entity, holds a signed agreement with each subcontractor that touches ePHI.

Treating cloud providers as exempt

A cloud host that stores encrypted data may still create, receive, maintain or transmit ePHI for you. Teams often skip review because the provider publishes standard terms or because the data is encrypted. Review whether the provider's service handles ePHI, whether it will sign a compliant agreement, and whether its terms cover the Security Rule requirements you must pass down. HHS guidance on cloud computing sets out these questions.

Missing sub-subcontractors

Flow-down reaches only as far as the contracts that exist. If your subcontractor uses its own hosting, support or backup vendor that can see ePHI, that vendor is a subcontractor too and needs its own written agreement. Ask each subcontractor to list the parties that handle PHI for it, and confirm that each one signed an agreement meeting the same terms. The gap often hides in managed services and offshore support.

Agreements signed after data moved

A contract signed after ePHI has already reached a vendor leaves a period of noncompliance that cannot be undone retroactively. This pattern appeared in OCR's MedEvolve resolution, where the business associate was cited for failing to enter a business associate agreement with a subcontractor. Compare the date each subcontractor first received data with the date its agreement was signed, and document any gap with a remediation record.

Ignoring known subcontractor breaches

Direct liability does not end at signing. A business associate that knows of a pattern of activity by a subcontractor that materially breaches the subcontractor's agreement must take reasonable steps to cure it or, if those fail, end the arrangement where feasible. A gap appears when an incident report, audit finding or failed test reaches the business associate and no one records a response. Keep a log of subcontractor findings and the action taken on each.

Flow-down terms that omit reporting

A subcontractor agreement that copies the security requirements but leaves out incident reporting can break the chain. Under 45 CFR 164.314(a)(2)(i), the contract must require the business associate to report security incidents, including breaches of unsecured PHI, to the covered entity. Subcontractors need matching reporting duties so the business associate can meet its own deadline. Check that each subcontractor agreement names a reporting window the business associate can meet.

Questions business associates ask about subcontractor agreements

Does a subcontractor need a business associate agreement?

Yes, if the subcontractor creates, receives, maintains or transmits PHI on your behalf. Under 45 CFR 160.103, a subcontractor that handles PHI for a business associate is itself a business associate. You must obtain satisfactory assurances from any subcontractor that handles ePHI for you under 45 CFR 164.308(b)(2), and those assurances must be in a written agreement. The agreement should meet the same requirements as the business associate agreement your covered entity requires from you. Confirm the subcontractor's role with a written data-flow map before you assume a service is outside the definition, such as a hosting or support provider that can see unencrypted data.

Can a covered entity require its own form of agreement?

Often yes, and you should check your customer contract before you draft anything. The Security Rule sets required content for business associate contracts under 45 CFR 164.314(a), including that the contract must require compliance with Subpart C, flow the same requirements down to subcontractors through compliant contracts, and report security incidents, including breaches of unsecured PHI. Your customer may supply its own template that adds terms beyond those minimums, such as notice periods or audit rights. Negotiate those terms with your legal team, and confirm that your subcontractor agreements can carry the same obligations without creating conflicts.

What effort does the subcontractor agreement work need from our team?

The effort is mostly inventory, legal review and tracking, not engineering. Your team needs to list every subcontractor that touches ePHI, record what each one does with the data, and confirm that each has a signed agreement that flows down the Security Rule duties. The work scales with the number of subcontractors, the number of customer contracts with different terms, and how well your systems already record vendor data flows. Ask any outside party for a fixed scope listing the inventory, the review of each agreement, and the gap register before work starts. Mention in the quote whether legal review is included or handled by your counsel.

Can we manage subcontractor agreements in-house?

Yes, many business associates do, provided someone owns the process end to end. The Security Rule places the duty on the business associate to obtain the agreements, so the accountable owner must be inside your organization even if counsel or a consultant does part of the drafting. An in-house team needs the subcontractor inventory, a standard flow-down template, a renewal calendar and a way to track incidents reported by subcontractors. If you lack a security or privacy officer with HIPAA experience, outside help can prepare the inventory and gap review while your team keeps ownership of decisions and signatures.

Who is liable if a subcontractor breaches PHI?

Your organization can be directly liable, not only the subcontractor. HHS states that a business associate is directly liable for failing to enter into agreements with subcontractors that create or receive PHI for it, and for failing to address a material breach of a subcontractor's agreement. The liability also extends to cases where you knew of a pattern of activity by a subcontractor that materially breached its agreement and did not take reasonable steps to cure it or, if those failed, terminate the arrangement where feasible. Treat subcontractor monitoring as a control with an owner and a record, not a one-time signature.

What happens if we find a missing agreement after data has moved?

Stop further data flow to that subcontractor, sign a compliant agreement as soon as counsel approves, and document the gap, the dates and the corrective steps. Then assess whether any security incident or breach of unsecured PHI occurred, because the contract must require you to report those to your covered entity. The MedEvolve case shows the exposure: in 2023 the business associate paid $350,000 after an FTP server holding PHI of 230,572 individuals at two covered entities was accessible on the Internet, and OCR also cited its failure to enter a business associate agreement with a subcontractor. Confirm your breach notice duties in each customer contract before you decide how to report.

How much does a subcontractor agreement review typically cost?

No single figure applies, because cost depends on how many subcontractors and customer contracts you have, and whether counsel or a consultant does the drafting. Costs fall into three groups: legal review and drafting, the internal time to inventory data flows, and any technical checks on subcontractor security. Legal fees are usually the largest one-time item, while inventory upkeep and annual renewals recur. Ask any provider for a written, fixed-scope quote that lists each agreement reviewed, the template changes included and the assumptions about existing contracts. DeployOpen does not publish prices, and a quote follows from the written scope.

How DeployOpen supports subcontractor evidence

DeployOpen helps business associates and their subcontractors prepare the systems, controls and records that show flow-down terms are being met. Engagements are fixed-scope, with the organization owning its agreements, controls and decisions, and an independent auditor or assessor issuing any report.

How we scope

Written scope lists which self-hosted platforms handle ePHI and which subcontractors touch them.
Scope maps each flow-down requirement in the business associate contract to a system, owner and evidence source.
Scope states what is excluded, such as legal drafting of agreements, which remains with counsel.

How we build

Configure access logging, encryption and backup on self-hosted platforms inside your own environment.
Set up subcontractor access, ticketing and incident reporting so terms can be checked and reported on time.
Test controls against the contract clauses, and record gaps for your team to resolve before handover.

How we hand over

Deliver configuration baselines, runbooks and a traceability register linking each contract term to evidence.
Document where each subcontractor agreement is stored, who signed it, and when it was last reviewed.
Provide evidence packages for your auditor or covered entity client, which they review independently.

How we support

Ongoing support and continuous testing are available as a retainer after handover.
Retainers can cover updating the evidence register when subcontractors, contract terms or systems change.
Ask in your quote how changes to subcontractor agreements will be scoped and priced.

HIPAA subcontractor business associates and flow-down agreements