The HHS sample business associate agreement, section by section

If you are an MSP, billing company or IT vendor about to send your first standard BAA to clinics and practices, the HHS sample is the obvious place to start. It is a public government text, free, and written by the regulator.

This page is a reading guide to it. It goes section by section, maps each section to the requirement in 45 CFR 164.504(e)(2) that it implements, and lists the bracketed choices the sample leaves to the parties. It doesn't fill in any of those choices. That is a decision for you, your clients and your counsel.

The sample has seven sections. Three carry the elements the regulation requires: the business associate's obligations, its permitted uses and disclosures, and term and termination. Definitions supports them. The other three consist entirely of clauses marked optional. HHS explains its convention up front: "Words or phrases contained in brackets are intended as either optional language or as instructions to the users of these sample provisions."

The sample leaves eight choices to the parties. Each is described below with the sample's own wording. Which option fits a given relationship is a question for the parties and their counsel.

1. How permitted uses are described. Under Permitted Uses and Disclosures (a), the sample offers "[Option 1 – Provide a specific list of permissible purposes.]" or "[Option 2 – Reference an underlying service agreement, such as 'as necessary to perform the services set forth in Service Agreement.']" It adds that the parties "should specify whether the business associate is authorized to use protected health information to de-identify the information."

2. Minimum necessary. Clause (c) offers uses and disclosures "[Option 1] consistent with covered entity's minimum necessary policies and procedures" or "[Option 2] subject to the following minimum necessary requirements", with specific provisions to be inserted.

3. The business associate's own uses. Clauses (e), (f) and (g) are each marked "[Optional]": use and disclosure for the business associate's "proper management and administration" or legal responsibilities, and data aggregation services. Including them changes clause (d) and the Permissible Requests section, which the sample says should then carry a matching exception.

4. Who gets access and accountings. For access to records (Obligations (e)), the parties "[Choose either 'covered entity' or 'individual or the individual's designee']". For an accounting of disclosures (Obligations (g)), they "[Choose either 'covered entity' or 'individual']". For access, amendment and accounting requests, the sample notes the parties may add detail on how the business associate responds when an individual asks it directly, and on timeframes.

5. Breach-reporting detail. After the reporting duty in Obligations (c), the sample says the parties "may wish to add additional specificity regarding the breach notification obligations of the business associate, such as a stricter timeframe" and whether the business associate "will handle breach notifications to individuals, the HHS Office for Civil Rights (OCR), and potentially the media" for the covered entity.

6. The term. The effective date and the termination date or event are left blank: "[Insert effective date]" and "[Insert termination date or event]".

7. A cure period. Termination for cause may include "[and business associate has not cured the breach or ended the violation within the time specified by covered entity]", which the sample says "may be added if the covered entity wishes to provide the business associate with an opportunity to cure."

8. PHI at termination. Option 1 applies "if the business associate is to return or destroy all protected health information" and retain no copies. Option 2 applies where the business associate may use PHI for its own management and administration and "needs to retain protected health information for such purposes after termination", with five conditions on what it keeps. The sample adds that the agreement could provide for transfer of PHI to another business associate of the covered entity, or for destruction of PHI held by subcontractors.

The sample covers HIPAA concepts only. HHS says the provisions "address only concepts and requirements set forth in the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules" and "do not include many formalities and substantive provisions that may be required or typically included in a valid contract."

So the commercial terms come from elsewhere: indemnity, limitation of liability, insurance, fees, governing law, notices, and how the BAA relates to your MSA or service agreement. HHS notes the provisions can be "incorporated into an agreement for the provision of services" or into "a separate business associate agreement". It also says reliance on the sample "does not replace consultation with a lawyer or negotiations between the parties to the contract." That is where your counsel comes in.

The regulation requires the business associate to ensure that subcontractors handling PHI on its behalf "agree to the same restrictions and conditions that apply to the business associate with respect to such information" (45 CFR 164.504(e)(2)(ii)(D)). The sample implements this in Obligations (d), and HHS says its language "may be adapted for purposes of the contract between a business associate and subcontractor."

For an MSP, that usually means two standard texts: the BAA you send clients, and the one you send your own subcontractors. Our article on BAA acceptance covers whether your subcontractors need a BAA too.

Once you and counsel have settled your BAA, the work shifts from drafting to sending: the same text to every covered-entity client, and a record of who accepted which version. Whether a click can accept a BAA is its own question, answered in can a BAA be accepted electronically.

Pacts handles the sending. You put your standard BAA on Pacts and send each client contact a page showing the full text with an accept step; no account is needed to accept. Each acceptance gets a certificate with a hash of the exact version accepted, and the coverage board shows which clients are on the current BAA and which aren't. No PHI enters Pacts: it holds the agreement and who accepted it, never patient data. Pacts doesn't draft the BAA or supply the HHS text; you bring your own.

Pacts for healthcare MSPs shows the setup, and your first BAA covers the moment you become a business associate.