Business Associate HIPAA Obligations Procedures

Free HIPAA procedures template · v1.0 · Applies to covered entities & business associates · Companion: Policy →

Free, no signup needed. Also as PDF · Markdown.

What these procedures commit you to

Adopting this document means committing to these HIPAA controls, the 45 CFR §164 requirements it helps satisfy, by area:

Vendor & BAA Management: 164.502(e)/.504(e)
Privacy: 164.502(a)(3) · 164.502(a)(4) · 164.502(a)/(b) · 164.514(d) · 164.502(b) / .514(d)

Related threat scenarios

Common threats (NIST SP 800-30 classes) that the controls behind this document defend against:

AccidentalAccidental disclosure / over-share
Exploits: No access controls on shares · 164.312(a) Access Control; 164.514(d)

HowToHIPAAhowtohipaa.com

Business Associate HIPAA Obligations Procedures

Template. These procedures operationalize the Business Associate HIPAA Obligations Policy. Replace [bracketed] items with your specifics and adjust steps to match your tools and team size.

Purpose

Repeatable, auditable steps for a Business Associate to keep PHI use and disclosure within its BAAs, enforce minimum necessary, respond to HHS and individual-rights requests, and handle PHI correctly at the end of a relationship. This implements the Business Associate HIPAA Obligations Policy.

1. Maintain the BAA register and permitted-use map (164.504(e))

Record every covered-entity BAA in the [BAA tracker]: counterparty, effective date, the PHI categories received, the permitted uses/disclosures, and the return-or-destruction terms.
For each engagement, map the systems and workforce roles that touch that PHI so §2 can be enforced.
Review the register [quarterly]; flag any BAA nearing renewal or any use not traceable to a BAA.

2. Enforce minimum necessary (164.502(b), 164.514(d))

See where your organization stands on the controls this template cites.

Join Us

Related Vendor & BAA Management templates

Breach Reporting to Covered Entity Policypolicy
Business Associate Agreement (BAA)reference
Business Associate HIPAA Obligations Policypolicy
Subcontractor Business Associate Agreementreference

More Vendor & BAA Management templates →Read the Vendor & BAA Management guide →

Grant access to PHI by role, least-privilege, through the Access Control process, never broad or standing access "just in case."
Before a new use or disclosure, confirm it is (a) permitted by the BAA and (b) limited to the minimum data needed; if either is unclear, route to the [Privacy Official] before proceeding.

3. Handle HHS and required-by-law requests (164.502(a)(4))

Route any request from HHS/OCR or a legal demand for PHI to the [Privacy Official] immediately. Do not respond directly.
The [Privacy Official] validates the request, notifies the affected covered entity where the BAA requires, assembles the responsive records, and logs the disclosure.

4. Relay and support individual-rights requests (164.504(e))

If an individual contacts [Organization] directly to access, amend, or get an accounting of their PHI, log it and forward it to the covered entity within [2 business days]. Do not action it unilaterally.
When the covered entity directs action, provide access to the designated record set, apply the directed amendment, or supply disclosure history within the BAA's timeframe, and record what was done.

5. Return or destroy PHI at termination (164.504(e))

On BAA termination, identify all systems, backups, and copies holding that covered entity's PHI.
Return or securely destroy it per the BAA; capture a return/destruction certificate (what, when, method, by whom).
Where destruction is infeasible (e.g., immutable backups), document why, continue the BAA's safeguards, and restrict further use until the data ages out.

6. Record and report incidents (164.502(a)(3))

Treat any use or disclosure outside the BAA as a potential incident; open it under the Security Incident Response process and, if it is a breach, follow the Breach Reporting to Covered Entity Procedure within the required timeframe.