What Must a HIPAA Business Associate Agreement Include?

A business associate agreement must set the permitted uses and disclosures of PHI and require the business associate to use appropriate safeguards, report impermissible uses and disclosures, breaches, and security incidents, bind applicable subcontractors to the same PHI restrictions and conditions, support individual rights, open its records to HHS, and return or destroy PHI at termination where feasible. Required elements appear in 45 CFR 164.504(e) and 164.314(a).

Required provisions. Under 45 CFR 164.504(e)(2), the contract must establish the permitted and required uses and disclosures of PHI. Generally, the agreement cannot authorize a use or disclosure that would violate the Privacy Rule if made by the covered entity; 45 CFR 164.504(e)(2)(i) provides specified management/administration and data-aggregation exceptions. It must require the business associate to:

• not use or disclose PHI other than as permitted by the contract or required by law;
• use appropriate safeguards and comply with the Security Rule for ePHI;
• report any use or disclosure not provided for by the contract, including breaches of unsecured PHI, and report any security incident of which the business associate becomes aware (45 CFR 164.314(a)(2)(i)(C));
• ensure that subcontractors agree to the same applicable restrictions and conditions (45 CFR 164.502(e)(1)(ii)), which are not necessarily identical commercial terms;
• make PHI available for access; make PHI available for amendment and incorporate amendments under 164.526; provide the information needed for accountings under 164.528;
• comply with the Privacy Rule when carrying out a covered entity's Privacy Rule obligation;
• make its internal practices, books, and records available to HHS;
• return or destroy PHI and retain no copies where feasible; if infeasible, extend contractual protections and limit further uses and disclosures to the purposes that make return or destruction infeasible (164.504(e)(2)(ii)(J)).

Termination. The contract must authorize termination by the covered entity if the business associate violates a material term.

Other arrangements. Governmental entities and certain other arrangements have specified alternatives (164.504(e)(3)). This is a general summary of required provisions, not a ready-to-use agreement.

Sample language. HHS publishes sample business associate agreement provisions and states that they alone may not be sufficient to result in a binding contract under state law.

Note. Learn Laws® is a training company, not a law firm. This FAQ summarizes federal rules for general information and is not legal advice. HHS and OCR do not endorse any private consultants' or education providers' seminars, materials or systems, and do not certify any persons or products as "HIPAA compliant."