Vendor & Business Associate Management Procedures

Vendor onboarding due-diligence checklist (representative). Business need documented & approved · data the vendor will access classified (does it include PHI?) · risk rating assigned (App. A) · SOC 2 / attestation reviewed (App. B) or security questionnaire completed · subcontractor/flow-down evidence requested where PHI is involved · contract terms (App. D) confirmed · BAA determination made (§2) and BAA executed if required (§3) · access provisioned per Access Control Policy · recorded in the vendor/BAA tracker (§4).

2. Business Associate determination (164.502(e), 164.308(b)(1))

1. For every new vendor (and at renewal), the Business Owner answers: will the vendor create, receive, maintain, or transmit PHI on [Organization]'s behalf, or have routine access to it?
2. If yes → the vendor is a business associate; a BAA is required before any PHI is disclosed (go to §3).
3. If no/unclear → route to the [Privacy Officer], who makes and records the determination. When access to PHI is reasonably possible, default to executing a BAA. A true conduit, or a vendor with genuinely no PHI access, does not require a BAA. Record that conclusion and the reason.
4. Record the determination (and rationale) in the vendor/BAA tracker (§4).

3. Executing the BAA (164.308(b)(1), 164.314(a)(2), 164.504(e)(2))

1. Use the approved [Organization] BAA template (see Appendix C: BAA template references). If the vendor insists on its own BAA, review it against the required-terms checklist below before acceptance.
2. Confirm the BAA contains every required term:
   • safeguards for PHI/ePHI (Security Rule compliance for ePHI);
   • permitted uses/disclosures only, and no use/disclosure that would violate the Privacy Rule;
   • subcontractor flow-down: same restrictions/conditions bind downstream subcontractors;
   • incident & breach reporting to [Organization] [without unreasonable delay and no later than 5 calendar days] of discovery (immediately for suspected unauthorized disclosure of PHI);
   • availability of PHI for individuals' access/amendment/accounting and to HHS;
   • return or destruction of PHI at termination (or continued protection if infeasible);
   • [Organization]'s right to terminate for a material breach.
3. Route for signature by an authorized signer for [Organization] (leadership retains signing authority) and the vendor's authorized signer.
4. Store the fully executed BAA in [document storage] and link it from the tracker (§4). Do not disclose PHI to the vendor until the BAA is executed.
5. Set a renewal/review date so BAA terms are re-confirmed at renewal (§5).

4. Vendor & BAA tracker (164.308(b)(1), 164.314(a)(2))

1. The [Privacy Officer] or delegate maintains a centralized vendor/BAA tracker in the [compliance tracking system], stored in a restricted location.
2. For each vendor, record, as applicable:
   • vendor name, service provided, and Business Owner;
   • risk rating (App. A) and business-associate flag (Y/N) with the §2 determination;
   • data classification the vendor can access (and whether it includes PHI);
   • BAA status (required? executed?) with effective/renewal dates and a link to the executed agreement;
   • whether subcontractor flow-down evidence has been obtained (for BAs handling PHI);
   • date of last review and next-review-due date;
   • contract details (start/end dates, link to executed contract) and primary contact.
3. The tracker is the system of record for demonstrating, on audit, that a BAA exists for every business associate and that vendors are reviewed on cadence.

5. Periodic vendor review (164.308(b)(1), 164.504(e), 164.314(b))

1. The [Privacy Officer]/[Security Official] opens a review record per the risk-based cadence: critical/BAs handling PHI: at least annually; high: at least every two years; low: as needed, and on any material event (scope change, vendor M&A, reported incident).
2. Re-confirm: the BAA is current and still contains the required terms; the vendor's attestation (SOC 2) is current and unqualified (re-run Appendix B); the vendor still meets its safeguard obligations; subcontractor flow-down remains in place where PHI is involved.
3. For group health plan arrangements, confirm the plan-document provisions at Policy §8 remain in force (sponsor safeguards, adequate separation, agent/subcontractor assurances, incident reporting) (164.314(b)).
4. If a business associate is in material breach of its BAA, take reasonable steps to cure; if the breach cannot be cured, terminate the agreement, or if termination is infeasible, report the problem to HHS (coordinate with counsel) (164.504(e)(1)(ii)).
5. Log findings, required remediation, and any rating change in the tracker; update the next-review date.

6. Vendor off-boarding / termination (164.308(b)(1), 164.504(e)(2)(ii)(J))

1. The Business Owner initiates off-boarding and completes the off-boarding checklist: return or secure destruction of [Organization]/customer data and PHI per the BAA's termination terms; removal of the vendor's system and facility access (per the Access Control Policy); and any data-migration/transition steps.
2. Where the business associate cannot feasibly return or destroy PHI, document this and confirm the BAA's protections continue to apply to the retained PHI with use/disclosure limited accordingly.
3. Obtain the vendor's confirmation of return/destruction where applicable, and update the vendor/BAA tracker to reflect the closed relationship.

Records produced (evidence)

Vendor risk assessments & due-diligence files · SOC report review notes (App. B) · business-associate determinations · executed BAAs and renewals · the vendor/BAA tracker · periodic vendor-review records · subcontractor flow-down evidence · group-health-plan plan-document amendments · off-boarding/return-or-destruction confirmations. These are the artifacts an auditor will request to confirm satisfactory assurances are obtained and maintained. Records are retained for at least 6 years.

HIPAA controls addressed

Appendix A: Vendor risk rating criteria

Any vendor that accesses PHI is treated as critical/business associate for BAA and oversight purposes regardless of operational dependence.

Appendix B: SOC report review checklist

Record the service organization, the auditor, and the report period, then answer Yes/No:

1. Was a clean/unqualified opinion issued (Independent Service Auditor's Report)?
2. Are the relevant complementary user-entity controls being performed by [Organization], with documentation to substantiate them?
3. For each exception in "Results of Testing," were compensating/mitigating controls at the service organization identified and successfully tested?
4. Does the report's scope include the applications/services [Organization] actually uses?
5. Was a contract/BAA review conducted?

Any "No" requires additional analysis (document the analysis and [Organization]'s compensating controls); if all "Yes," enter "Not applicable." Record who completed the review and the date.

Appendix C: BAA template references

• [Organization] standard BAA template: the approved baseline containing all required terms in Policy §3; this is the default instrument for any business associate.
• Vendor's own BAA: acceptable only after review against the Policy §3 / Procedures §3 required- terms checklist by the [Privacy Officer] (and [Security Official] for security terms).
• HHS sample business-associate-agreement provisions: the U.S. Department of Health & Human Services publishes model BAA provisions that may be used as a reference baseline; tailor to the engagement before use.
• Group health plan plan-document amendment: the template language amending plan documents to carry the § 164.314(b)(2) sponsor obligations (used in addition to any BAA).

Appendix D: Contract provisions and considerations

Beyond the BAA, vendor contracts should cover, at minimum: contract timeframes and scope of service; service levels (SLAs) and reporting; cost/fee structure; rights, responsibilities, and remedies; protection of intellectual property; security and confidentiality (compliance with [Organization]'s security requirements when handling its data); obligations and timeframes for reporting security incidents; data used solely for contracted purposes; backup and disaster- recovery responsibilities; and termination with timely return of data. Best-practice clauses: notification/approval rights for material changes to services, controls, key personnel, or service locations; dispute resolution with continuation of services; indemnification; and [Organization]'s right to review the vendor's security policies, procedures, and controls on request.

Review & version

Reviewed at least annually by the [Privacy Officer] (with the [Security Official]). v1.0.