Sort by one question: does a separate party create, receive, maintain or transmit electronic protected health information for you? A hosted API or cloud service that does is a subcontractor question. A library that runs only inside your own environment is code you operate. Confirm edge cases with counsel, since this is not legal advice.
The rule text behind the question
For business associates, the Security Rule says contracts must ensure that any subcontractors that create, receive, maintain or transmit electronic protected health information agree to comply with the applicable requirements (45 CFR 164.314(a)(2)(iii) applies the same terms to subcontractor contracts). So the practical test is about who touches the data, not about whether something is a "dependency" in a package file.
Three kinds of dependency
| Kind | Example shape | Touches PHI outside your environment? | Typical handling |
|---|---|---|---|
| Library or package | A parser, a UI kit, an ORM | No, runs in your process | Vulnerability and license management |
| Hosted service called by your code | Email, SMS, logging, error tracking, transcription | Yes, if PHI is sent | Contract review, BAA if it holds PHI |
| Infrastructure | Cloud hosting, managed database, backups | Yes | Contract review, BAA, configuration |
The middle row is where teams get surprised. A library is harmless to the BAA question until it quietly sends data somewhere. Analytics SDKs, crash reporters and "telemetry" options are common examples.
How to build the map
- List every outbound destination your application contacts in production. Network egress logs and your SBOM together will show most of them.
- For each destination, ask what data can reach it. Check payloads and log lines, not just feature descriptions.
- Mark any destination that can receive PHI, including by accident in an error message.
- For each marked destination, find the agreement on file and note the date.
- For libraries that call out by default, check whether the call can be turned off and whether it is off.
Step 3 deserves care. If PHI can only reach a vendor through a mistake, the right fix is usually to stop the leak and also to ask whether the agreement should exist anyway.
What to tell a hospital reviewer
A reviewer wants a short list: the hosted services in your PHI path, the agreement in place for each, and a statement about libraries. You can say that libraries run inside your environment and are managed through your vulnerability process, and that you review any component that sends data off host before approval.
Try it yourself
Click through it at your own pace, or open it full screen. Use it to see how a full component list is produced, then compare it with your egress list to spot packages that talk to outside services.
Safeguard's SBOM and dependency scanning can supply the component side of that comparison. The mapping of which services may receive PHI, and whether an agreement is needed, is a decision for your compliance owner and counsel.
Quick check
Does an open source library need a BAA?
A library you run in your own environment is not a separate party receiving data, so the BAA question normally does not arise. The question changes if the library sends data to a service.
What if our error tracker captured PHI once?
Treat it as a data handling issue first: stop the leak, scrub what you can, and involve your compliance owner on whether the agreement and any notification duties apply.
Sources
Last reviewed: 19 October 2026.
