tools

Business Associate Agreement Checklist

By Art Kukharenko · Published 2026-10-17 · Updated 2026-10-18

Use this worksheet to record your own requirements, assumptions and evidence. The supplied rows are research or illustrative examples, not a regulatory filing, vendor quote or completed assessment.

How to use this worksheet

Download the CSV and preserve the source and assumption columns.
Replace example values with your own documented information.
Review the result with the accountable technical, procurement or legal owner.

Read the supporting guide for context and return to the tools library.

Business Associate Agreement Checklist

Research snapshot checked on 2026-10-17. Sort any column and retain source dates when reusing records. iAge dataset reuse terms cover the original compilation; third-party source rights remain separate.

Search records

19 of 19 records match.

Scroll horizontally to compare all columns ↔

Business Associate Agreement Checklist

1	Which products, modules and features does the BAA cover?	Coverage is product-specific. Vendors publish covered-service lists, and features outside them (beta features, connectors, add-ons, higher or lower plan tiers) are not protected by the BAA.	The BAA names each covered product and plan tier; the vendor's current covered-services list is attached or linked; changes to the list require written notice.	The BAA refers only to 'the platform' or 'the services' with no list; a HIPAA badge on the website is the only evidence; coverage exists only on a tier you did not buy.	45 CFR 164.502(e)(1); 164.504(e)(1)-(2); 160.103 (definition of business associate)
2	Which integrations, connectors, destinations and AI features sit outside the BAA?	Data forwarded to a connector, ad platform, plug-in or third-party model leaves the BAA's protection unless that downstream party has its own BAA.	A written list of excluded features; those features are off by default in PHI workspaces; each downstream destination you may enable is listed with its BAA status.	'Integrations are your responsibility' with no list; AI features are on by default; no way to block destinations per workspace.	45 CFR 164.502(e)(1)(ii); 164.504(e)(2)(ii)(D); 164.308(b)(1)
3	Which fields may contain PHI, and which are prohibited?	Vendors often bar PHI from names, tags, profile fields, workspace labels and support tickets because those fields are logged or visible to more staff.	Published field-level rules; validation or masking controls; written guidance on event and attribute naming.	No field guidance; PHI accepted in free-text support tickets; identifiers appear in billing or diagnostic logs.	45 CFR 164.502(b); 164.504(e)(2)(ii)(B)
4	Who are the sub-processors, and does each sign a BAA or equivalent flow-down?	A business associate may pass PHI to a subcontractor only with satisfactory assurances, and the subcontractor must accept the same restrictions and conditions.	A current sub-processor list with function and location; flow-down confirmed in writing; advance notice of changes and a right to object.	List available on request only; no notice of changes; sub-processors without PHI-level terms.	45 CFR 164.502(e)(1)(ii); 164.504(e)(2)(ii)(D); 164.314(a)(2)(i)(B)
5	How is PHI encrypted in transit and at rest, and who holds the keys?	Encryption is an addressable Security Rule specification, and properly encrypted data can count as 'secured' for breach notification. Key custody decides who can ever read the data.	Current TLS in transit; strong encryption at rest; customer-managed or bring-your-own-key option; documented key rotation and separation between tenants.	Vendor-held keys only with no alternative; encryption described only as 'bank-grade'; keys shared across tenants.	45 CFR 164.312(a)(2)(iv); 164.312(e)(1); 164.402 (unsecured protected health information)
6	How is access controlled, including access by the vendor's own staff?	Support and engineering access is a common source of exposure. The Security Rule calls for unique user identification, access limited to authorised persons or programs, and authentication.	SSO and MFA; role-based access; vendor staff access only through approved, time-limited, logged requests; optional customer approval of each session.	Standing administrative access for vendor staff; shared accounts; no MFA for customer administrators.	45 CFR 164.312(a)(1); 164.312(a)(2)(i); 164.312(d)
7	What is logged, can you see the logs, and how long are they kept?	Audit controls must record and examine activity in systems that hold ePHI. You need logs to investigate incidents and to answer accounting-of-disclosure requests.	Tamper-evident logs of access, reads and changes involving PHI; export to your own monitoring; retention that at least matches your record-retention policy; logs protected as PHI.	No customer-visible audit log; logs on request only; logs overwritten within days; logs hold unprotected PHI.	45 CFR 164.312(b); 164.308(a)(1)(ii)(D); 164.316(b)(2)(i) (six-year documentation retention)
8	What copies of PHI exist during the term (backups, caches, abuse-monitoring and prompt logs), and how long do they live?	Every copy widens the breach surface and complicates deletion and return. AI features often keep prompts and outputs for abuse monitoring.	A written retention schedule per data store; configurable retention; zero- or short-retention options for AI features; a deletion process with confirmation that covers backups.	'We retain data as long as necessary' with no schedule; no deletion path for backups; log copies kept outside your region.	45 CFR 164.504(e)(2)(ii)(B) and (J); 164.502(b)
9	How fast must the vendor notify you of a security incident or breach, and what must the notice contain?	The regulatory outer limit for a business associate's notice is 60 calendar days from discovery. Your own notice to individuals is due within 60 days too, and the clock can start earlier if the vendor is your agent.	Notice of a confirmed breach within 24 to 72 hours of discovery and a shorter window for suspected incidents; 'security incident' defined; notice names affected individuals and data elements; named contact; cooperation duty.	'Without undue delay' with no number; notice only after the investigation ends; only confirmed breaches count; no definition of unsuccessful attempts.	45 CFR 164.410; 164.404(a)(2); 164.314(a)(2)(i)(C); 164.504(e)(2)(ii)(C)
10	What happens to PHI when the contract ends?	The BAA must provide for return or destruction of PHI at termination where feasible, and continued protection where it is not.	Export in open formats within a stated period; certified destruction including backups by a stated date; written explanation and extended protections if return is infeasible.	Fees for export; destruction 'in the ordinary course' with no date; no certificate; data kept for the vendor's own analytics.	45 CFR 164.504(e)(2)(ii)(J)
11	May the vendor de-identify or aggregate your PHI, and to what standard?	De-identification by a business associate is itself a use of PHI that the BAA must permit. De-identified data falls outside HIPAA, which is why vendors want the right.	No de-identification or aggregation unless the BAA allows it; if allowed, the standard is Safe Harbor or Expert Determination, with no re-identification, no sale and an audit right.	Broad right to 'anonymise' data for benchmarking or product improvement; 'anonymised' with no named standard.	45 CFR 164.502(d); 164.514(a)-(b); 164.504(e)(2)(i)(B)
12	Does the vendor use PHI for its own purposes, including product improvement and AI model training?	A BAA permits only the uses it lists, plus the business associate's own management and administration and legal responsibilities. Model training on PHI is not among them unless the contract says so.	An express prohibition on use for training, analytics, advertising and benchmarking, written into the BAA and not only a privacy page; the same limits bind sub-processors.	Training controlled by an account toggle that the BAA never mentions; terms allowing use of 'service data' for improvement.	45 CFR 164.504(e)(2)(i); 164.504(e)(4); 164.502(a)(3)
13	Where is PHI stored and processed, and who can reach it from outside the United States?	HIPAA does not ban offshore storage, but OCR guidance says it can raise risk, and payer contracts or state rules may restrict it.	Named regions; support access only from approved locations; a contractual commitment on location; disclosure of any follow-the-sun support.	'Global' processing by default; support staff in unspecified locations; location changes without notice.	No express HIPAA prohibition; see OCR cloud computing guidance (October 2016); 164.308(a)(1)(ii)(A) risk analysis
14	How does the product enforce minimum necessary?	Covered entities and business associates must make reasonable efforts to limit PHI to the minimum necessary. Product controls make that practical.	Field-level allowlists; role-based views; purpose tags; masking and suppression; the ability to block PHI fields from outbound destinations.	All-or-nothing access; every field synced by default; no way to block fields from destinations.	45 CFR 164.502(b)
15	What audit rights and assurance reports do you get?	The BAA must make the business associate's internal practices, books and records available to HHS. You need your own assurance through reports and, where justified, audits.	A current SOC 2 Type II or ISO 27001 report that covers the in-scope services; a penetration-test summary; a right to audit after an incident; an HHS access clause.	The report excludes the product you buy; no audit right even after an incident; reports more than a year old.	45 CFR 164.504(e)(2)(ii)(I); 164.308(a)(1)(ii)(A)
16	How does the vendor support individual rights requests (access, amendment, accounting of disclosures)?	The BAA must require the vendor to make PHI available for access and amendment and to supply information for an accounting of disclosures. The covered entity must act on an access request within 30 days.	A defined turnaround measured in days; an API or export for records in a designated record set; a log of disclosures.	Manual tickets with no service level; no way to find records by individual.	45 CFR 164.504(e)(2)(ii)(E)-(G); 164.524
17	Can you terminate for breach, and what transition help is included?	The BAA must let the covered entity end the contract if the vendor violates a material term. You also need time to move without leaving PHI in two places.	Termination for material breach with a short cure period; transition assistance and export during a wind-down; PHI protections survive termination while data is retained.	Termination only at renewal; no cure or wind-down terms; data withheld during disputes.	45 CFR 164.504(e)(2)(iii); 164.504(e)(2)(ii)(J)
18	What cyber insurance, liability caps and indemnities apply to a breach?	Breach costs (notification, monitoring, forensics, regulatory defence) can exceed a fees-based liability cap, and a vendor that cannot pay leaves you carrying the loss.	Insurance certificates with limits matched to your exposure; a separate, higher cap or an uncapped indemnity for data breaches; reimbursement of notification costs.	The general cap (for example twelve months of fees) applies to data breaches; no evidence of insurance; indemnity excludes notification costs and regulatory penalties.	No direct HIPAA requirement; commercial term
19	What is the vendor's security-incident and enforcement history?	Past incidents show how the vendor detects, reports and remediates. Your risk analysis should consider the vendors that hold your PHI.	Disclosure of incidents from the last three to five years with root cause and fixes; no unresolved regulatory actions; a written statement from the vendor's security lead.	Refusal to discuss incidents; repeated similar incidents; qualified audit opinions.	45 CFR 164.308(a)(1)(ii)(A); 164.308(b)(1)

Download full CSV

General information, not legal advice. Read the supporting analysis.

Put this evaluation into practice.

Assess your deployment requirements

This article is general information, not legal advice.

Business Associate Agreement Checklist

How to use this worksheet

Business Associate Agreement Checklist

Further reading