Business Associate Agreements in Medical Billing

A business associate is the outside party — a billing company, a clearinghouse, a collections agency, a software or storage vendor — that handles PHI to perform work for a practice. The business associate agreement is the contract between the two. The distinction matters because the rule treats them differently: the business associate is who does the work, and the BAA is the written instrument that makes the arrangement permissible in the first place.

The Privacy Rule permits a covered entity to disclose PHI to a business associate, or to let a business associate create, receive, maintain, or transmit PHI on its behalf, only if the covered entity first obtains satisfactory assurances that the business associate will safeguard the information (45 CFR 164.502(e)(1)). Those assurances are not a handshake — the rule requires them to be documented through a written contract or other written arrangement that meets the content requirements of 45 CFR 164.504(e) (164.502(e)(2)). The BAA is that document.

The trigger is function, not job title: an agreement is required whenever an outside party will create, receive, maintain, or transmit PHI to perform a service for the practice. The business-associate definition at 45 CFR 160.103 lists the kinds of work that qualify — claims processing and administration, billing, data analysis, utilization review, practice management — and the revenue cycle is full of them. A third-party billing service, a clearinghouse acting beyond a pure transmission role, a collections agency, and the software or hosting vendors whose systems hold claim data are all business associates, and each needs a BAA before it receives PHI.

Some relationships that look similar do not require a BAA, and knowing the boundary keeps a practice from papering over a relationship the rule leaves alone. The definition at 160.103 excludes several parties, and two matter most in billing:

The conduit

An entity that only transports PHI and has at most random or incidental access to it — a courier, the postal service, an internet service provider carrying data — is not a business associate. The line the rule draws is routine access: a service that requires access to the information on a routine basis to do its job is a business associate; one that merely moves a sealed package is a conduit. A vendor that stores or processes claim data is well past the conduit line.

The treating provider

A disclosure of PHI from one provider to another for the treatment of the patient does not make the receiving provider a business associate (45 CFR 160.103). Sending records to a referring physician for care is a treatment disclosure, not a business-associate relationship — a different lane from sending claim data to a billing vendor.

The rule does not leave the content of a BAA to the parties' imagination. 45 CFR 164.504(e)(2) sets out what the contract must establish and require. The first piece is scope: the agreement establishes the permitted and required uses and disclosures of PHI by the business associate, and it may not authorize the business associate to use or disclose the information in a way the covered entity itself could not (164.504(e)(2)(i)). Within that limit, the contract may allow the business associate to use PHI for its own proper management and administration and to provide data aggregation services for the covered entity's operations.

On top of scope, the agreement must require the business associate to do a defined set of things (45 CFR 164.504(e)(2)(ii)):

• Not use or further disclose the information except as the contract permits or as required by law.
• Use appropriate safeguards — and, for electronic PHI, comply with the Security Rule — to prevent uses or disclosures the contract does not allow.
• Report to the covered entity any use or disclosure not provided for by the contract that it becomes aware of, including breaches of unsecured PHI.
• Ensure that any subcontractors it uses to create, receive, maintain, or transmit PHI agree to the same restrictions and conditions that apply to the business associate.
• Make PHI available so the covered entity can meet a patient's right of access and right to amend, and provide the information needed for an accounting of disclosures.
• To the extent the business associate carries out one of the covered entity's own Privacy Rule obligations, comply with the requirements that apply to the covered entity in doing so.
• Make its internal practices, books, and records relating to PHI available to HHS for determining the covered entity's compliance.
• At termination, return or destroy all PHI if feasible — and, where it is not feasible, extend the agreement's protections to the information and limit further use to what makes return or destruction infeasible.

Finally, the contract must authorize the covered entity to terminate it if the covered entity determines the business associate has violated a material term (164.504(e)(2)(iii)). Those are the required bones of the agreement; parties routinely add more — indemnification, insurance, cooperation on patient requests — but the provisions above are what make the document a BAA rather than an ordinary vendor contract.

It is easy to think of the BAA as a Privacy Rule instrument, because that is where the requirement to obtain a written contract before disclosing PHI lives (45 CFR 164.502(e), 164.504(e)). But the Security Rule imposes a parallel requirement of its own. Whenever a business associate will handle electronic PHI, the covered entity may permit it only after obtaining satisfactory assurances, documented in a written contract, that the business associate will appropriately safeguard the information (45 CFR 164.308(b)).

The Security Rule then specifies what that contract must say (45 CFR 164.314(a)): the business associate will comply with the applicable Security Rule requirements, will ensure that subcontractors handling electronic PHI enter into a contract to do the same, and will report to the covered entity any security incident it becomes aware of, including a breach of unsecured PHI. In practice this is not two separate documents — a single, well-drafted BAA satisfies both rules — but it does mean an agreement that addresses privacy and is silent on security is incomplete whenever electronic data is in play, which in a modern billing operation is always.

A business associate rarely works alone. Its own cloud host, its analytics vendor, its document-storage provider — each is a party the business associate delegates work to, and if that work involves PHI the rule follows the data downstream. A subcontractor that creates, receives, maintains, or transmits PHI on behalf of a business associate is itself a business associate under 45 CFR 160.103, and needs its own agreement.

The obligation to obtain that downstream agreement sits with the business associate, not the covered entity. The rule requires a business associate to obtain satisfactory assurances from its subcontractors on the same terms a covered entity must obtain from the business associate (45 CFR 164.502(e)(1)(ii)), and the content requirements of a BAA apply to the business associate–subcontractor contract to the same extent they apply to the covered entity–business associate contract (164.504(e)(5)). The obligations flow down the chain unchanged; they do not weaken with each link.

For years, a business associate's HIPAA obligations reached it only through its contract with the covered entity — the practice, not the government, was the enforcer. The HITECH Act changed that, and the 2013 Omnibus Rule implemented it: business associates became directly liable to federal enforcement for the HIPAA requirements the statute made applicable to them. A business associate is now bound by regulation as well as by the BAA.

Direct liability reaches specific duties — among them impermissible uses and disclosures of PHI, failing to comply with the Security Rule, failing to notify the covered entity of a breach, failing to make records available to HHS for an investigation, and failing to enter into compliant agreements with subcontractors. It does not turn a business associate into a covered entity for every purpose: obligations that the rules apply to a business associate only through its contract remain a matter for the covered entity to enforce, not the government. HHS publishes a fact sheet enumerating the categories of direct liability, and it is the authoritative place to see the full list.

A BAA is not a document that gets signed once and filed. Applying the rule well is a matter of a few operational habits built around the agreements a practice holds.

1. 01

   Inventory every vendor that touches PHI

   List the outside parties that create, receive, maintain, or transmit claim data — billing service, clearinghouse, collections agency, EHR and practice-management systems, hosting and backup vendors — and confirm each has a current signed agreement. The vendors that get missed are usually the software and infrastructure ones, because they feel like tools rather than parties.
2. 02

   Execute the agreement before any data moves

   Make the signed BAA a precondition of onboarding a vendor, so PHI is never disclosed ahead of the contract the Privacy and Security Rules require (164.502(e), 164.308(b)).
3. 03

   Confirm the required terms are actually present

   Check the agreement against the provisions the rule requires (164.504(e)(2), 164.314(a)) rather than assuming a vendor's standard form is complete. A missing return-or-destroy clause or a silent security section is a gap even when both parties meant well.
4. 04

   Require flow-down to subcontractors

   Ensure the agreement obligates the business associate to bind its own subcontractors on the same terms (164.502(e)(1)(ii), 164.504(e)(5)), so the protections follow the data down the chain.
5. 05

   Act on a pattern of material breach

   If the practice becomes aware of a pattern of activity that is a material breach of the agreement, take reasonable steps to cure it and, if that is unsuccessful, terminate the contract where feasible (164.504(e)(1)(ii)). Knowing of the pattern and doing nothing is itself a compliance failure.
6. 06

   Close out the data when the relationship ends

   At termination, hold the vendor to the return-or-destroy obligation (164.504(e)(2)(ii)) — and where returning or destroying the PHI is genuinely infeasible, confirm the agreement's protections continue to apply to whatever is retained.

The BAA is one instrument inside the larger set of duties the HIPAA Privacy Rule in medical billing creates — the permission to use PHI for payment at all — and it works alongside the minimum necessary standard, which limits what a practice and its business associates disclose even when a BAA is in place. The wider set of regulatory duties sits in the Compliance and Regulations category. Because the rules are revised and their enforcement guidance evolves, agreements should point to the current regulation and be reviewed when it changes.