Domain H: Business Associate & Subcontractor Management
Business associate agreements in place before a business associate handles PHI: a covered entity obtains assurances from each business associate, and a business associate obtains the same from subcontractors that handle PHI on its behalf.
Some items in this domain are written for one entity type. Items marked Business Associates only or Covered Entities only apply to that type; unmarked items apply to every HIPAA-regulated organization.
Every item here is already part of the current, final HIPAA Security Rule. Items marked NPRM: would become Required are currently Addressable, OCR’s pending 2025 proposed rule would eliminate that flexibility and make them mandatory if finalized (not yet in effect).
Signed BAA on file for every covered-entity relationship
45 C.F.R. §164.504(e) · Source: www.ecfr.gov/current/title-45/section-164.504
Signed BAA on file for every downstream subcontractor with PHI access
45 C.F.R. §164.308(b)(2); 164.502(e)(1)(ii) · Source: www.ecfr.gov/current/title-45/section-164.308
Subcontractor BAAs flow down the same restrictions the organization itself received
45 C.F.R. §164.502(e)(1)(ii); 164.504(e)(2)(ii)(D); 164.504(e)(5); 164.314(a)(2)(i)(B) · Source: www.ecfr.gov/current/title-45/section-164.502
Vendor security due-diligence process performed before onboarding a subprocessor
45 C.F.R. §supports 164.308(a)(1) scope · Source: www.ecfr.gov/current/title-45/section-164.308
Active subcontractor BAAs and their security posture reassessed on a periodic cycle
45 C.F.R. §supports 164.308(a)(1) scope · Source: www.ecfr.gov/current/title-45/section-164.308
Every vendor that meets the business associate definition (it creates, receives, maintains, or transmits PHI on the organization's behalf, or provides a listed service that involves disclosing PHI to it) is identified and recorded in the BAA tracker before PHI is disclosed to it
45 C.F.R. §160.103; 164.502(e)(1) · Source: www.ecfr.gov/current/title-45/section-164.502
Signed Business Associate Agreement containing every required element on file with each business associate before PHI is disclosed to it, documenting the satisfactory assurances the Privacy Rule requires
45 C.F.R. §164.502(e); 164.504(e)(2) · Source: www.ecfr.gov/current/title-45/section-164.502
Due diligence on a business associate's safeguards performed before contracting and repeated on a periodic cycle for those that hold or process ePHI
45 C.F.R. §supports 164.308(a)(1) scope; 164.308(b) · Source: www.ecfr.gov/current/title-45/section-164.308
A known material violation of a BAA by a business associate is cured or the arrangement terminated where feasible, and the steps taken are documented
45 C.F.R. §164.504(e)(1)(ii) · Source: www.ecfr.gov/current/title-45/section-164.504
Security requirements are applied when acquiring information technology systems and services
45 C.F.R. §164.308(a)(1) · Source: www.ecfr.gov/current/title-45/section-164.308
A named coordinator measures business associate performance and re-checks the business associate list for completeness
45 C.F.R. §164.308(b)(1) · Source: www.ecfr.gov/current/title-45/section-164.308