What 164.314(a) requires in a business associate contract
If you are a covered entity or business associate that must show your vendor terms meet 164.314(a), the contract itself is the evidence. It must commit the business associate to comply with the Security Rule, require the business associate to flow the same duties down to any subcontractor that handles electronic protected health information, and require it to report any security incident it becomes aware of, including breaches of unsecured PHI under 164.410. Under 45 CFR 164.314(a)(1), these contract terms are marked as required, so an assessor will look for each element in the signed language rather than accept a general commitment to privacy or security. Read the text itself at 45 CFR 164.314(a)) before you review any vendor paper.
This requirement is distinctive because it tests contract content, not a technical control. No scan, configuration setting or log will show that a business associate agreement is adequate, and no addressable analysis applies. A reviewer checks whether each required clause is present, whether it binds the business associate to Subpart C as a whole, and whether the incident reporting duty reaches breaches of unsecured PHI and not only events the vendor chooses to call incidents. Ask legal counsel to map each required element to a specific section number in your template, then keep that map with the contract file so the evidence can be produced quickly.
The hard part is usually the chain, not the first contract. A covered entity may have a direct agreement with a clearinghouse, which in turn relies on a cloud host, a transcription firm and a support contractor, and each link must carry compliant terms under 164.314(a)(2)(iii). Older agreements signed before the current terms, or agreements that point to a vendor's standard online addendum, often fail the test because they lack the security incident clause or never name subcontractors. Start with an inventory of every business associate and every known subcontractor, confirm which agreements predate your current template, and prioritize renegotiation for vendors that hold the largest volumes of ePHI. Confirm with counsel how any proposed rule changes would affect your template, since the pending revision is not final.
Which vendor relationships fall under the 164.314(a) contract test
The 164.314(a) contract requirement applies wherever a covered entity or business associate hands ePHI to another party that will create, receive, maintain or transmit it. The cards below sort the relationships that trigger the test, the arrangements that look similar but change the work, and the determinations you should record so an assessor can follow your reasoning.
Covered entity and business associate
A covered entity that engages a business associate under 164.308(b)(3) must obtain satisfactory assurances in a contract or other arrangement that meets 164.314(a). The test turns on function, not job title: a cloud host, billing service, transcription vendor or managed IT provider that creates, receives, maintains or transmits ePHI for you is usually a business associate. Inventory each vendor against the actual data flow, not the contract label.
Business associate and its subcontractors
A business associate that passes ePHI to a subcontractor must make sure that subcontractor agrees to comply through a compliant contract. This flow-down applies at every tier that touches ePHI, so a hosting provider's support firm or a developer's offshore contractor can fall in scope. Ask each business associate for a current list of subcontractors that handle ePHI and confirm that each has signed terms.
Alternative arrangements under 164.504(e)(3)
A covered entity may rely on another arrangement that meets 164.504(e)(3) instead of a standalone business associate agreement, and the same 164.314(a) content requirements then apply between a business associate and its subcontractor. Confirm with counsel that the arrangement is an actual written document that carries every required term. A memorandum or purchase order that omits security reporting terms does not satisfy the test.
Vendors with no ePHI access
A vendor that never creates, receives, maintains or transmits ePHI does not fall under the 164.314(a) contract test, even if it runs in the same building or cloud account. Typical examples are a janitorial contractor, a furniture supplier or a software vendor that works only on de-identified data. Validate the claim by reviewing access rights, support sessions and data flows, because a vendor with administrative access to an ePHI system may still touch it.
Vendors with incidental or conduit exposure
Some vendors see ePHI only briefly, such as a postal carrier, a courier or a network provider that carries encrypted traffic without storing it. Document whether the vendor retains, reads or can reasonably access the information, because that determination drives whether it is a business associate. Record the reasoning in your risk analysis file so the decision can be reviewed later.
Documenting the scoping determination
Keep a vendor register that lists every third party with system or data access, the ePHI categories involved, the contract or arrangement that applies, and the date of the last review. For each vendor that is out of scope, record the reason and who approved it. Assessors and OCR investigators typically ask for this register first, so an undocumented determination is hard to defend.
How an assessor tests the business associate contract
This table compares the three required contract elements under 164.314(a) by the evidence an assessor requests and the findings that commonly appear. Read each row as a checklist for your own contract file: if the evidence named in a row cannot be produced quickly, the element is likely to be a finding. The main takeaway is that an assessor tests the signed document and the chain of agreements behind it, not only a policy statement that a vendor is compliant.
| Required element | Evidence an assessor requests | Common findings |
|---|---|---|
| Security Rule compliance commitment | Executed business associate contract or other arrangement that states the business associate will comply with Subpart C, with signature dates and the parties named | Unsigned or expired agreements, template language never countersigned, or a commitment that refers only to HIPAA generally without naming the Security Rule |
| Subcontractor flow-down | Register of subcontractors that handle ePHI, with a compliant written agreement for each and the link from each subcontractor back to the prime business associate | Missing subcontractor agreements, subcontractors named in service descriptions but absent from the contract file, or terms that do not match the prime contract |
| Security incident reporting | Incident clause stating that the business associate reports any security incident it becomes aware of, including breaches of unsecured PHI under 164.410, plus the notice mechanism and contact | Reporting windows that are not stated, incident clauses limited to confirmed breaches, or no defined route for notifying the covered entity |
| Contract coverage across the relationship | Inventory of every vendor relationship that creates, receives, maintains or transmits ePHI, matched to a signed contract or other arrangement under 164.308(b)(3) | Vendors with ePHI access but no contract on file, or contracts that predate a new service or data flow |
| Version and renewal history | Dated contract versions, amendments and renewal records showing the current terms are the ones in force | Amendments referenced but not attached, renewals signed on old templates, or no record of who approved changes |
| Termination and return of ePHI | Termination clause and records showing how ePHI was returned or destroyed when the relationship ended | Termination clauses silent on ePHI, or no evidence the covered entity confirmed return or destruction |
How to bring vendor contracts into line with 164.314(a)
This sequence takes a covered entity or business associate from an unknown vendor population to contracts that carry the three required 164.314(a) elements, with evidence on file for every subcontractor that touches ePHI. The outputs are a register, a gap record, executed amendments and a tracking calendar that stays current after the first pass.
Inventory every business associate and subcontractor
Start with every vendor, hosting provider, billing company, managed IT provider and software supplier that creates, receives, maintains or transmits ePHI for you, then trace the chain one level further to find their subcontractors. Procurement, IT and the privacy or security lead should each check the list against their own records, because accounts paid for outside central purchasing are the usual gap. The output is a vendor register that records the service, the data types involved, the systems touched and the agreement that governs each relationship. The step is done when every system in your ePHI data map points to a named vendor entry.
Confirm the agreement type for each relationship
For each register entry, record whether the relationship runs under a business associate contract, an arrangement that meets 164.504(e)(3), or a subcontractor contract between a business associate and its own vendor. Legal or the compliance lead should own this classification, since a vendor that only sees de-identified data or has no access to ePHI may sit outside the requirement. The output is a column in the register showing the instrument in force and its effective date. Where no written instrument exists, flag the entry as an immediate gap rather than assuming one is coming.
Build a clause gap matrix against the three elements
Review each agreement against the three required elements in 164.314(a)(2): a commitment to comply with Subpart C, a requirement that subcontractors handling ePHI agree to comply through a compliant contract, and a duty to report any security incident the vendor becomes aware of, including breaches of unsecured PHI under 164.410. Record, for each vendor, whether each element is present, absent or only implied, and quote the clause that supports your finding. The output is a clause gap matrix with one row per vendor and one column per element. Have counsel confirm the reading of any ambiguous wording before you mark it compliant.
Amend or replace deficient terms
For each gap, decide whether a short amendment will close it or whether the agreement should be replaced with your current template. Legal drafts the change, and the vendor's authorized signatory executes it, with both parties keeping a signed copy. Ask the vendor to name the specific incident reporting channel and contact in the revised clause so that the reporting duty can be tested later. The output is executed amendments or replacement agreements, each logged in the register with its signature date. The step is done when the matrix shows no open gaps or a documented, approved exception.
Obtain subcontractor flow-down evidence
Ask each business associate to show, in writing, that its subcontractors handling ePHI are bound by agreements that meet the same standard, and to name those subcontractors. Review a sample of these flow-down terms against your own clause matrix, and request a replacement or amendment where the terms fall short. Do not accept a general statement that subcontractors are compliant, because the regulation asks for an agreement. The output is a subcontractor list per vendor, a copy or summary of the flow-down terms, and a note of any vendor that refused, which feeds a risk decision.
Set a tracking cadence and renewal calendar
Assign an owner for the vendor register and set a recurring review tied to contract renewals, service changes, new subcontractors and any security incident reported by a vendor. Record each review date, the reviewer and any change to the matrix. Keep the register and signed agreements under document control so that earlier versions remain retrievable. The output is a renewal calendar and a dated review log. Confirm with counsel how often the business associate and subcontractor records should be reviewed, since the current rule does not set an interval. Proposed changes to the Security Rule would add a 24-hour notice of contingency plan activation, so revisit the template when that rule is final.
How duties flow down to subcontractors
The business associate must push its Security Rule duties down to every subcontractor that creates, receives, maintains or transmits electronic protected health information. Under 45 CFR 164.314(a)(2)(i), the business associate's contract must require each subcontractor handling ePHI to agree to comply with the Security Rule through its own compliant contract. The covered entity's contract with the business associate does not reach the subcontractor directly, so a first-tier agreement alone leaves the subcontractor chain unprotected. The same contract requirements also apply between a business associate and its subcontractor under 164.314(a)(2)(iii), which makes each link in the chain answerable for the next one.
Covered entities should therefore ask the business associate to show the whole chain, not just its own paper. Ask for a current list of subcontractors that touch ePHI, the executed subcontractor agreements or a summary of their Security Rule terms, and an explanation of how the business associate learns about new subcontractors before they receive data. Ask how each subcontractor reports security incidents upward, since the business associate's own reporting duty under 164.314(a)(2)(i) depends on learning about incidents that happen further down the chain. Hosting providers, managed service firms and offshore support teams are common places where this chain becomes hard to see.
Have counsel confirm the exact wording of every flow-down clause, the notice and approval mechanics for new subcontractors, and how liability is allocated when a subcontractor fails. This page does not provide legal advice, and the regulation sets minimum content, not a template. Confirm the terms against the current eCFR text of 45 CFR 164.314 and any sub-regulatory guidance that applies to your arrangement before relying on them.
Evidence that shows 164.314(a) is met
Section 164.314(a) is satisfied by documents, not by intent. The artifacts below form one chain: each business associate relationship is backed by a signed agreement, each subcontractor is tied to that agreement, and every change is recorded so an assessor can see what was in force on any given date.
Executed business associate agreements
The signed business associate contract, or the 164.504(e)(3) arrangement a covered entity relies on, is the primary artifact. Check that it is fully executed by both parties, names the business associate and the ePHI services in scope, and contains the three required provisions: compliance with Subpart C, subcontractor flow-down, and security incident reporting. An unsigned draft or a template without a counterparty name is not evidence. Ask whether the agreement reflects the current services, not the ones signed at onboarding.
Subcontractor agreements
Where a business associate passes ePHI to a subcontractor, the same contract requirements must apply between them. Keep a copy of each downstream agreement, or a signed attestation that it meets the requirement, alongside the upstream contract. Assessors commonly trace a single ePHI flow from the covered entity to the final processor, so gaps usually appear at the second or third tier. Confirm that each subcontractor agreement is dated and that its scope matches the data it actually receives.
Vendor register
A vendor register lists every business associate and subcontractor that creates, receives, maintains or transmits ePHI, with the contract that governs each one, the data categories involved, the named owner inside your organization and the hosting location. It is the index an assessor uses to test whether the agreements are complete. Reconcile it against accounts payable, cloud billing and access reviews, because a register that omits a SaaS tool used by one clinic is a common finding.
Amendment and version history
Business associate agreements change when services, data types or regulations change, and the version in force at a given date is what matters for an audit. Keep every amendment with its effective date and signatories, and keep superseded versions rather than overwriting them. A wiki or document system with version control, which records what changed, when and by whom, and allows comparing and restoring earlier versions, gives you this history without manual file naming. Open-source options include XWiki, which keeps page history by design.
Security incident notification clauses
The contract must require the business associate to report any security incident it becomes aware of, including breaches of unsecured PHI. Evidence here means the clause text plus the operating record: the incident log, the dates on which notices were sent, and the escalation path inside both organizations. Confirm the clause names who receives notice and by what channel. The January 2025 proposal would add a 24-hour contingency plan activation notice, but that change is not final, so confirm current contract terms before adding it.
Renewal and access tracking
Agreements expire, auditors change, and vendors are replaced, so the evidence must stay current between audits. Record each agreement's review date, renewal owner and termination trigger in a tracker, and set reminders before expiry. Restrict who can edit contract records using role-based permissions, so that a reader cannot silently alter a signed copy. Review the register at least when a vendor onboards, changes scope or leaves, and when the Security Rule changes.
Who owns the vendor contract, who prepares the evidence, and who assesses it
The covered entity or business associate owns the contract or other arrangement required by 164.314(a). The organization decides which vendors and subcontractors handle electronic protected health information, negotiates the terms, and signs the agreement. Responsibility for compliance with the Security Rule stays with the organization, even when a vendor performs the technical work.
- Signatory authority: An officer with authority to bind the organization signs each agreement, and the signed copy is kept in the vendor record.
- Required terms: The contract must address Security Rule compliance, subcontractor flow-down and incident reporting, including breaches of unsecured PHI.
- Negotiated positions: Any deviation from the standard terms, such as reporting timelines or audit rights, is decided and documented by the organization.
- Renewal and change control: The organization tracks expiry dates and re-papers the relationship when services or subcontractors change.
- Legal drafting: The wording itself belongs to the client's counsel, who should confirm that the clauses match the current regulation and the organization's own risk decisions.
Ask counsel to confirm which clause language the organization will use before any implementation partner begins preparing the vendor register.
An implementation partner can prepare the operational records that show the contract requirements are being tracked. This work does not replace the organization's own judgment, and the partner does not decide whether a vendor is compliant. The output is organized material the organization reviews and adopts.
- Vendor register: A maintained list of every business associate and subcontractor that handles ePHI, with the service, data types and contract status.
- Clause gap analysis: A comparison of each existing agreement against the 164.314(a) requirements, flagging missing or outdated terms for counsel.
- Evidence folder: Signed agreements, incident reporting paths, subcontractor attestations and the dates each was last reviewed.
- Access and workflow records: Documented steps showing how security incidents from a vendor reach the covered entity or business associate.
- Handover: A written scope defining which records the partner prepared, who approved them and where they are stored.
Before accepting the folder, confirm that the organization's own security official has reviewed each record and that the work scope is fixed in writing.
An independent reviewer tests the record without relying on the organization's or the partner's summary. In an OCR investigation, the agency reviews the documentation the entity can produce. In a customer or certification-style review, an independent auditor or assessor samples contracts and incident records and forms its own conclusion. Only that independent party issues a report or opinion.
- Sampling: The reviewer selects vendors and contracts, then checks whether the signed terms match the requirement.
- Traceability: The reviewer follows a vendor from the register to the signed agreement to the incident path.
- Limits of reports: DeployOpen does not issue audit reports, attestations or certifications, and an engagement with DeployOpen does not create one.
- HHS position: HHS does not endorse private certifications, and no Security Rule standard requires an entity to certify compliance.
- Reviewer selection: The organization chooses its reviewer, agrees the scope in writing and confirms the reviewer's independence from the work being tested.
Before engaging any reviewer, ask what the report will and will not cover, and confirm that the scope includes the contracts and subcontractor chains.
What meeting 164.314(a) costs in money and effort
What does it cost to meet 164.314(a) for business associate contracts?
No dollar figure is supplied for this requirement, so no published estimate can be quoted here. The cost is a mix of internal staff time and outside legal or consulting fees, and it scales with how many business associates and subcontractors you have. The main components are legal review of the contract language, negotiation with vendors who push back on terms, building and maintaining a register of agreements, and chasing subcontractor assurances down the chain. Ask any advisor to break the estimate into these components so you can see where the money and hours go.
Which parts of 164.314(a) work are one-time and which recur?
Most of the initial effort is one-time: reviewing your template, rewriting the Security Rule clauses, and renegotiating existing agreements to include them. The work that recurs is ongoing. You need to check new vendors before they handle ePHI, track amendments, confirm that subcontractors have compliant contracts, and revisit agreements when the Security Rule changes. If the January 2025 proposed rule is finalized, the contract terms you wrote would need updating, which is a second round of legal and negotiation effort. Budget for the recurring tracking work from the start, not as an afterthought.
What makes the cost of business associate contracts go up?
Cost rises with the number of business associates, how much PHI each one handles, and how deep the subcontractor chains go. A vendor that hosts ePHI and uses three or four downstream providers creates far more tracking work than a single-function tool with no subcontractors. Other drivers include vendors who refuse standard terms, contracts that sit in different legal entities or jurisdictions, and the absence of a central register, which forces staff to search email for signed agreements each time an audit or incident occurs. Reducing the number of vendors that touch ePHI is often the most effective cost control.
How much effort is subcontractor chasing under 164.314(a)?
Subcontractor chasing is often the least predictable part of the work. The requirement is that a business associate ensures its subcontractors that handle ePHI agree to comply through a compliant contract, so you may need to confirm the contracts two levels down, not only with your direct vendor. Effort grows with each layer, because each subcontractor must be identified, its agreement located and checked, and gaps followed up. Ask your vendors to provide a current list of subcontractors that handle ePHI and to attest that their agreements meet the requirement, then confirm that attestation on a schedule.
What should I ask for in a quote for 164.314(a) work?
A useful quote lists the scope in writing before work starts. Ask for the number of agreements to be reviewed, whether the work covers template drafting, individual vendor negotiation, subcontractor review and register setup, and which of these the provider expects you to do yourself. Ask who performs legal review and whether the provider is a law firm or a technical advisor, because only a lawyer can advise on contract terms. Also ask what is delivered at the end, such as an updated template, a tracking register and a maintenance procedure, and what ongoing support costs after the first round.
Can we handle the 164.314(a) contract work ourselves?
Yes, many organizations do the work in-house, especially when they have few vendors and an experienced legal or procurement team. The Security Rule text is short, so the drafting is manageable. The effort that is hard to do well without a plan is tracking: keeping a current register, following subcontractor chains, and handling renewals across many vendors. DeployOpen implements and documents systems inside a client's own infrastructure, and can help set up the records and evidence that show the agreements are tracked, but DeployOpen is not a law firm and does not give legal advice on contract terms. Decide which parts you will own and which you will buy before you start.
Does 164.314(a) add a recurring cost when vendors change?
Yes. Every new business associate, every change in a vendor's subcontractors and every contract renewal adds a small amount of recurring work. Vendor changes are especially costly when they happen mid-year and the agreement must be amended before data moves. Build a simple intake step into procurement so that no vendor receives ePHI before its contract is signed and recorded. That step costs little each time, but skipping it creates remediation work later, when the gap is harder and more expensive to close.
Who pays for what when a contract gap is found?
The covered entity or business associate that signed the agreement carries the compliance obligation, so it typically pays for the internal time to find and fix the gap, plus any legal fees to amend the contract. The vendor usually bears its own cost to update its subcontracts. If a gap is found during an audit or after an incident, the cost can grow quickly, because reconstructing missing records takes staff time and may require outside counsel. Ask your legal and procurement team to agree on who handles amendments and who approves the final language before the first contract is signed.
Open-source tools that track vendor contract evidence
Three open-source tools can hold the evidence behind a business associate contract register: framework assessments, versioned vendor documentation and role-controlled access. Each one stores records about contracts, not legal conclusions, so the contract terms themselves still need review by counsel.
Framework assessments with CISO Assistant
CISO Assistant (AGPL-3.0-only) is an open-source governance platform that ships more than 200 frameworks and runs assessments against them. For 164.314(a), you can record each business associate's answers to the Security Rule contract elements, such as compliance commitments, subcontractor flow-down and incident reporting, as assessment results with linked evidence. Check whether the community edition's framework library and reporting cover the HIPAA content you need, and confirm the license terms with your legal team before you deploy it for vendor-facing work.
Version-controlled vendor documentation in XWiki
XWiki (LGPL-2.1-or-later) keeps every change to a page under version control, recording what changed, when and by whom. Store each business associate agreement summary, its amendment history and the date its incident reporting clause was last reviewed as wiki pages. Auditors and OCR investigators ask when a term took effect, so you can compare any two versions and roll back when an edit was wrong. Confirm that your retention settings match the six-year documentation period in 45 CFR 164.316.
Role-based contract register access in BookStack
BookStack (MIT) assigns abilities through roles and lets you override permissions per role at the shelf, book, chapter or page level. Use it to hold the contract register so that the privacy and security team can edit clauses, while business unit managers see only the vendor status pages they own. Restrict who can view signed agreements, because the register will contain PHI-adjacent details such as subcontractor names and data flows. Test the permissions with a sample account before you rely on them.
Limits of evidence storage
All three tools store evidence about contracts, not legal conclusions. A record that a vendor answered yes to a flow-down question does not prove the subcontract meets 164.314(a)(2)(iii), and a completed assessment does not replace a review of the signed agreement. Decide who signs off each register entry, keep the signed contract as the controlling document, and note in each record which person reviewed it and when.
Common questions about 164.314(a) contracts and outside help
Does a business associate agreement alone satisfy 164.314(a)?
Only if it contains the required terms. A business associate agreement satisfies 164.314(a) when it states that the business associate will comply with Subpart C, requires subcontractors that handle ePHI to agree to comply through a compliant contract, and requires reporting of any security incident the business associate becomes aware of, including breaches of unsecured PHI under 164.410. Signing a template is not enough on its own. Check each element against the text of the regulation and confirm that the subcontractor flow-down and incident reporting terms are present, not implied.
How long does it take to put 164.314(a) contract terms in place, and what does it need from us?
The timeline depends on how many business associate relationships you have, how many already contain the required terms, and how many subcontractor chains must be traced. Most of the effort is inventory and negotiation, not drafting. You will need a current list of vendors that create, receive, maintain or transmit ePHI, copies of existing agreements, the names of the people who can approve contract changes, and a view of which vendors use subcontractors. Ask any partner to confirm the duration in writing against that inventory before work starts.
Can our own team handle 164.314(a) contract work in-house?
Often yes for the inventory, gap review and tracking, and usually a lawyer is needed for the final language. Your privacy or security staff can list vendors, compare existing agreements to the required elements and record which subcontractor chains are covered. Counsel should draft or approve the contract terms, because they carry legal liability and must fit your existing agreements and the vendor's own contracts. Decide early who owns the register, who signs off and how the register will be kept current after the first pass.
What can an implementation partner prepare, and what must counsel draft?
A partner can prepare the working material that supports the contract: a register of business associates and subcontractors, a gap analysis against 164.314(a)(2), an incident reporting procedure that feeds the contract's reporting clause, and evidence that shows how the terms are operated. Counsel drafts or approves the legal text, negotiates with vendors and decides on liability terms. DeployOpen prepares systems, controls and evidence for compliance assessments, and does not draft legal contracts or issue attestations. Put the split of responsibilities in the written scope.
Does a certificate prove that our business associate contracts comply with HIPAA?
No. There is no HIPAA certification. HHS states that no Security Rule standard requires an entity to certify compliance, that HHS does not endorse or recognize private organizations' certifications, and that such certifications do not prevent HHS from later finding a violation. A vendor that displays a certificate from a private firm has not thereby shown that its contracts meet 164.314(a). Ask for the signed contract terms and the evidence that the subcontractor and incident reporting clauses are operated in practice.
How would the proposed rule change on contingency-plan notice affect our contracts?
The January 2025 proposed rule would require business associates to notify covered entities within 24 hours of activating their contingency plans. It was proposed, not final, and as of October 2026 no final rule has been published. Today, your contracts should follow the current regulation. If the rule is finalized, you would need to amend the contract to add the notice term and align incident and contingency procedures with it. Ask counsel to draft a contract amendment clause that takes effect on the final rule's effective date, so you are not renegotiating every agreement at once.
What should we check in a subcontractor chain under 164.314(a)?
Start with the business associate's list of subcontractors that handle ePHI, then confirm each has a contract that meets the same requirements that apply to the business associate. Engineers should check which systems each subcontractor touches, how incidents reach the business associate and how quickly that path runs in practice. Ask the business associate to show the contract clauses and the incident escalation runbook, not only a policy statement. Record gaps in the register and track them to closure.
What the proposed rule would add to business associate terms
The most concrete change the January 2025 proposed rule would add to business associate terms is a 24-hour notice duty: business associates would have to notify covered entities within 24 hours of activating their contingency plans. The proposal appeared in 90 FR 898 with comments due March 7, 2025. It is a proposal, not a requirement. As of October 2026 no final rule has been published, and the latest Unified Agenda entry for RIN 0945-AA22 lists the rulemaking under Long-Term Actions with final action projected for July 2027. Until a final rule is published, the obligations you sign today are the ones in 45 CFR 164.314(a) and the contract terms you negotiated under them.
Business associates and covered entities should treat the proposal as a planning input rather than a drafting instruction. A covered entity's contract manager should ask whether the business associate's contingency plan activation triggers are documented, who makes the activation decision, and how quickly the on-call contact is reached outside business hours. A business associate should confirm that its incident and contingency runbooks can produce a notice inside that window if the final text keeps it. Any such check should use the wording of the final rule once it exists, since the proposed timing, triggers and scope could change during the comment process.
Before the final rule is published, review your business associate agreement templates and subcontractor flow-down language against the final text, not the proposal. Add a review trigger to your contract calendar, and ask counsel to confirm whether any amendment will be needed once the final rule is issued and what effective date applies. Refer to the eCFR text of 45 CFR 164.314(a)) for the current obligations, and keep a dated record of which template version each vendor signed.
How DeployOpen prepares vendor contract evidence
The sequence turns a vague worry about vendor contracts into a written scope, a complete register of business associates and subcontractors, a clause-by-clause gap list for counsel, and an organized evidence folder. DeployOpen prepares that material, while the covered entity or business associate owns its contracts and the decisions about them.
Agree the scope in writing
DeployOpen and the client agree in writing which contracts, arrangements and business associates are in scope, which systems handle electronic protected health information, and which documents will be delivered. The client's legal counsel confirms that the list of agreements matches the organization's own view of its vendor relationships. The output is a signed scope document that sets the deliverables and the boundary of the work before any review begins. Nothing starts until that document is accepted.
Collect the vendor and subcontractor register
The client's team supplies every vendor that creates, receives, maintains or transmits electronic protected health information for the organization, including hosting providers, managed IT providers and software vendors with remote access. DeployOpen then asks each vendor to name its own subcontractors that touch that data, which creates the second tier that 164.314(a) reaches. The register records each party, the service, where the data sits and which agreement governs it. The register is complete when the client confirms that no known vendor is missing and every entry has a named contract or a documented gap.
Locate each signed agreement
For every register entry, the team retrieves the signed business associate contract or the other arrangement that the organization relies on, with its amendments and any click-through terms that apply. Where no signed document exists, the entry is marked as a gap rather than assumed to be covered. The client confirms the version it treats as current. The output is an index that links each relationship to a specific document and effective date, so an assessor can trace any vendor to its paperwork.
Build the clause gap analysis
DeployOpen compares each located agreement against the three things 164.314(a) requires: compliance with Subpart C, flow-down to subcontractors that handle the data, and reporting of security incidents, including breaches of unsecured PHI. The team records each agreement as meeting, partly meeting or silent on each element, with the clause reference. The output is a gap table written for counsel, not a legal opinion. Counsel decides what the language means and whether an amendment is needed.
Hand amendment decisions to counsel
The gap table goes to the organization's counsel, who decides which agreements need amendment, which need a new arrangement and which are acceptable as written. DeployOpen does not draft binding legal terms or advise on enforceability unless a separate legal engagement is in place. The client records each decision, the owner and the date it was made. This step closes when every gap has a documented disposition from counsel, even if that disposition is to accept the risk.
Assemble the evidence folder
DeployOpen organizes the register, the agreement index, the gap table, counsel's decisions and the signed amendments into a single evidence folder with a short index that maps each item to the 164.314(a) element it supports. Where the organization uses an open-source documentation platform, the folder can be kept under version control so that changes and their authors are visible. The folder is ready for review when the client's compliance lead has checked that each referenced document exists and is current.
Hand over for independent review
The organization gives the evidence folder to its own compliance function and, where it chooses, to an independent assessor or auditor. The assessor forms its own view and issues any report or opinion. DeployOpen does not issue audit reports, certifications, attestations or legal opinions on whether a contract is compliant. The handover is complete when the client confirms receipt and records which person owns the folder going forward.
Sources and further reading
- 45 CFR 164.314(a), eCFR ↗
- NIST SP 800-66 Rev. 2, Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide ↗
- HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, proposed rule ↗
- Unified Agenda entry for RIN 0945-AA22, reginfo.gov ↗
- HHS OCR's HIPAA Audit Program ↗
