How to HIPAA: Vendor & BAA Management
Free HIPAA guide · 8 controls · 9 templates
Business associate agreements and downstream subcontractor assurances. The sections below are assembled from the same control catalog, threat library, and enforcement mapping our free assessment runs on.
Why this matters
- Business associates & subcontractors
- A business associate is directly liable for the Security Rule and must flow equivalent terms down to subcontractors. A missing or weak BAA means PHI is moving to a party with no enforceable safeguards, and the breach becomes yours to answer for.
The controls in this area
The 45 CFR §164 requirements HIPAA places here: 8 of the 103 controls in our catalog. Our free templates and assessment track each one:
164.308(b)(2)-(3) · 164.314(a)(1) · 164.314(a)(2) · 164.314(b) · 164.502(e)/.504(e) · 164.502(e)(1)(ii) · 164.504(e)(2)(ii) · 164.504(e)
What enforcement looks like here
OCR's recurring investigation findings in this area:
- Business associate agreements 164.308(b) / 164.502(e)
Related threat scenarios
Common threats (NIST SP 800-30 classes) that this area's controls defend against:
- AdversarialThird-party / subcontractor compromise
Exploits: Missing BAA; weak vendor controls · 164.308(b) / 164.502(e) BA Contracts
Free templates for this area
De-branded policy and procedures templates mapped to this area's controls. Read the full text free, then adapt them to your organization:
See where your organization stands on the 8 controls in this area.
Join Us