A HIPAA business associate agreement must set the permitted uses and disclosures of PHI, require the vendor to use safeguards and report problems, flow the same terms to subcontractors, support individual rights, open records to HHS, require return or destruction of PHI at the end, and let the covered entity terminate for a material breach.
Why the contract exists
A covered entity may let a business associate handle electronic PHI only if it gets satisfactory assurances that the associate will safeguard it. Section 164.308(b) says those assurances must be documented in a written contract or other arrangement. The required terms live in 164.504(e) for privacy and 164.314(a) for security.
The required terms
From 164.504(e)(2), the contract must:
- Establish permitted and required uses and disclosures, and not allow anything the covered entity itself could not do. Narrow carve outs exist for the vendor's own management and administration and for data aggregation services.
- Require the associate not to use or further disclose PHI except as the contract permits or the law requires.
- Require appropriate safeguards and compliance with the Security Rule for electronic PHI.
- Require reporting of any use or disclosure not provided for by the contract, including breaches of unsecured PHI.
- Require subcontractors that handle PHI to agree to the same restrictions and conditions.
- Make PHI available for individual access, amendment and the accounting of disclosures.
- Require compliance with the Privacy Rule where the associate carries out a covered entity duty.
- Make internal practices, books and records available to the Secretary of HHS.
- At termination, if feasible, return or destroy all PHI and keep no copies, or extend protections if that is not feasible.
- Authorise termination if the associate violates a material term.
The security side in 164.314(a)(2) adds three duties: comply with the applicable Security Rule requirements, make sure subcontractors agree to comply too, and report any security incident the associate becomes aware of, including breaches of unsecured PHI.
Where negotiation actually happens
The regulation sets a floor. Real agreements add detail on things the rule leaves open:
- Reporting windows. The breach rule gives business associates up to 60 days, but customers often ask for much shorter contractual windows. Know what you can meet.
- Security incident scope. The Security Rule term covers any security incident of which you become aware, so define how you will report unsuccessful attempts such as routine port scans.
- Subcontractor lists. Customers may want notice of new subprocessors.
- Data location and return format. Spell out what return or destruction looks like, and when destruction is certified.
Because the details are commercial and legal, have counsel review the final text. This article describes the regulatory minimums only.
Engineering follow-through
A contract promise needs a system behind it. Match each clause to something you can show: an incident runbook for the reporting clause, a deletion job for the return clause, an inventory of subprocessors for the flow-down clause. See also is your software company a business associate.
Quick check
Do I need a BAA with my own subcontractors?
Yes, if they create, receive, maintain or transmit PHI for you. The same contract requirements apply between a business associate and its subcontractor.
Can a BAA let the vendor use PHI for its own product analytics?
The contract may not authorise uses the covered entity could not make itself, apart from narrow carve outs for the vendor's management and administration and for data aggregation. Ask counsel before relying on any broader use.
Sources
- 45 CFR 164.504(e), business associate contracts
- 45 CFR 164.314, organizational requirements
- 45 CFR 164.308, administrative safeguards
Last reviewed: 19 October 2026.
