At the end of a business associate contract, the rule text says the vendor must, if feasible, return or destroy all protected health information it still holds and keep no copies. If that is not feasible, the contract protections continue and use is limited to the reasons return or destruction is infeasible.
What the text covers
The contract requirements describe protected health information the associate received from, or created or received on behalf of, the covered entity. It includes information held "in any form." That reaches backups, logs, exports, support tickets and analytics copies, not just the production database.
The same duty flows down. The associate must make sure subcontractors that hold the data agree to comply, so a vendor's cloud host or support tool can also hold your data after you leave.
Where copies hide
| Location | Why it gets missed | What to ask |
|---|---|---|
| Backups | Retained on a schedule | When do they expire and who confirms |
| Logs and traces | Treated as telemetry | Do they contain identifiers |
| Support tickets and screenshots | Owned by support staff | Can they be purged |
| Test and staging copies | Created for debugging | Were they ever loaded |
| Subcontractor stores | Not in your contract | Who holds data and under what terms |
| Exports and reports | Emailed or shared | Where did copies go |
A termination checklist
- Send a written notice that states the data return or destruction request and a deadline.
- Export your data in a usable format and check a sample before deletion starts.
- Ask the vendor to list every system and subcontractor that holds your data.
- Ask for written confirmation of destruction, with the method and date.
- For anything that cannot be destroyed, such as a legal hold, get a written statement of why and confirm that contract protections continue.
- Revoke accounts, API keys, single sign on connections and integrations on your side the same day.
- Keep the paperwork. The rules include documentation duties, so check retention with counsel.
Common mistakes
Teams cancel billing and assume the data is gone. They forget service accounts and tokens still working. They accept an email saying "deleted" with no scope. Treat destruction like any other control: ask for evidence.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
What if the vendor says deletion is not feasible?
The text allows the contract protections to continue and limits use to the reasons that make deletion infeasible. Get that stated in writing and set a review date.
Does this apply to backups?
The text says information the vendor still maintains in any form, so ask how backups are handled and when they expire.
Sources
Last reviewed: 19 October 2026.
