What a Business Associate Agreement Actually Covers

A Business Associate Agreement is required whenever a vendor handles protected health information on a practice's behalf. It usually gets signed as a formality. The clauses that matter are the ones nobody reads.

What it actually allocates

Permitted uses. What the vendor may do with PHI, and what they may not. Narrower is better.

Safeguards. What the vendor commits to implement.

Breach notification. How quickly they must tell you, and in what detail. This is the clause with real operational consequence — your own notification obligations run on a clock that starts when you learn of a breach.

Subcontractors. Whether the vendor may pass PHI to others, and on what terms.

Return or destruction at termination, which is easy to agree and hard to enforce later if it is vague.

The subcontractor clause

This is where exposure hides. A vendor may subcontract work — including offshore — and if the clause permits it broadly, PHI can reach parties you never evaluated.

The questions worth asking directly: do you subcontract any part of this work, is any of it performed outside the United States, and are those subcontractors bound by equivalent terms? A vendor who cannot answer plainly has not thought about it.

The practical checks

• Breach notification measured in days, not "promptly".
• Subcontractor use disclosed rather than merely permitted.
• Offshore handling stated explicitly if it occurs.
• Return or destruction with a defined timeframe.

The specific terms are a matter for your own counsel. The point here is that the agreement is doing real work and is worth reading once.