In 2017, OCR announced a $31,000 settlement with an Illinois provider unable to produce a signed BAA for years of disclosures. The Center for Children’s Digestive Health case shows what can happen when the required agreement is missing.
A signed BAA may still leave your HIM team uncertain about who handles delayed patient access requests or misrouted records. The contract must match the work that actually moves between your organization and the vendor.
A HIPAA business associate agreement (BAA) governs a vendor’s permitted uses and disclosures of protected health information (PHI). It also establishes required safeguards and other responsibilities. For a release of information (ROI) vendor, review that agreement alongside the services agreement and the live workflow.
Table of contents
When Does a Medical Record Release Vendor Need a BAA?
A medical record release company generally qualifies as a business associate when it handles PHI to perform services for a covered entity. That can include receiving requests, accessing patient records, preparing disclosures, and delivering completed records.
The distinction depends on the service, not the vendor’s label. HHS explains the business associate definition and exceptions in its guidance on business associates. For example, a courier that only transmits PHI may qualify for the conduit exception. A vendor that routinely accesses records to perform release work generally does not.
When comparing medical records release companies, identify who will manage intake, processing, communication, and exceptions. The contract package should match those assignments.
What Must a HIPAA Business Associate Agreement Include?
A HIPAA business associate agreement must address specific contractual requirements, including the permitted uses of PHI and the vendor’s responsibilities. HHS offers sample business associate agreement provisions that parties can adapt to their arrangement.
| Required Area | What to Check for an ROI Vendor |
|---|---|
| Permitted uses and disclosures | What PHI the vendor may use, and for which contracted functions |
| Limits on further disclosure | Only as the BAA permits or requires, or as required by law |
| Safeguards | Required PHI protections, including applicable Security Rule obligations |
| Incident and breach reporting | Reporting of impermissible uses, security incidents, and breaches |
| Subcontractors | Applicable HIPAA restrictions and conditions for downstream parties |
| Individual rights support | Access, amendment, and accounting support when applicable |
| Delegated Privacy Rule duties | Compliance with duties the vendor performs for the covered entity |
| HHS access | Availability of records required for compliance review |
| Return or destruction | Handling of PHI when the relationship ends, subject to the applicable rules |
| Termination | Rights and remedies for a material contract violation |
These provisions set the legal baseline. The services agreement should also identify who owns intake, disclosure validation, requestor communication, and failed deliveries. Contract language is much less useful if staff still have to guess who owns the next action.
What Should You Verify in the Vendor’s BAA?
Use an actual request scenario, not just a contract checklist. If the HIM analyst handling an exception cannot identify the next owner, close that workflow gap before launch.
Does PHI Access Match the Release Workflow?
Trace a request from intake through verification, chart access, disclosure preparation, and delivery. At each step, confirm which systems and PHI the vendor can access and why.
Where minimum necessary applies, the BAA must restrict PHI uses, disclosures, and requests consistently with the covered entity’s policies. HHS addresses those limits in its minimum necessary guidance for business associates. Patient access disclosures follow different rules, so the team should not apply one disclosure pathway to every request.
A BAA permits appropriate sharing with a business associate for the contracted work. It does not independently authorize every release to an outside requestor. The underlying disclosure still needs a valid legal basis.
Who Handles Patient Access and Other Individual Rights?
The HIPAA Right of Access under 45 CFR 164.524 and authorization requirements under 45 CFR 164.508 address different disclosure pathways. They should not be treated as interchangeable with the business associate contract.
The BAA may direct the vendor to provide records to individuals or make them available to the covered entity for fulfillment. HHS confirms that the covered entity remains responsible for applicable individual rights obligations.
Document who classifies the request, contacts the individual, and returns unresolved requests to HIM. The same clarity is needed for amendment requests and applicable accounting duties.
How Will the Vendor Report an Incident?
An impermissible use or disclosure, a security incident, and a breach of unsecured PHI are not necessarily the same event. The agreement should address the reporting duties that apply to each.
For a breach covered by 45 CFR 164.410, the vendor must notify the covered entity without unreasonable delay. The outside limit is 60 calendar days after discovery, subject to the rule’s exceptions. Your internal escalation process should trigger sooner.
Specify the first contact, the reporting channel, the contractual notice deadline, and the cadence for updates. An HIM leader should not have to search a contract while an incident is unfolding.
What Happens With Subcontractors and Vendor Exit?
Applicable restrictions and conditions must flow down to subcontractors handling PHI on the vendor’s behalf. Ask where PHI can move, which parties may receive it, and who escalates a downstream problem.
Under 45 CFR 164.504(e), the BAA must address returning or destroying PHI when feasible. It must also provide continued protection when neither option is feasible. The parties should understand what happens to vendor-held copies and any data that must remain protected.
These contract terms do not transfer the provider’s clinical record retention decisions to the vendor. HHS confirms that HIPAA sets no general medical record retention period. State law and other requirements may govern how long the provider must retain records.
Revisit the agreement when a vendor adds a system connection, introduces a subcontractor, or takes on a new release function. Those changes can expand PHI access or shift responsibilities without changing the original contract.
Medical Record Release Vendor BAA Checklist
Before approving a vendor or changing the release workflow, confirm the following:
- The BAA, services agreement, and actual workflow describe the same scope of work.
- Patient access and authorization-based requests follow the appropriate processes.
- PHI access matches each contracted function and the systems involved.
- Your team knows who owns requestor communication, failed deliveries, and escalations.
- Incident contacts, reporting deadlines, and update expectations are written down.
- Subcontractor responsibilities and end-of-contract PHI handling are addressed.
- The covered entity retains control of its clinical record retention and destruction requirements.
Test these answers against one request that previously required HIM intervention. If responsibility still changes hands without a named owner, resolve that gap before requests go live.
For wider compliance documentation and oversight, our HIPAA audit checklist for HIM leaders covers evidence beyond the BAA.
Review Your Release of Information Workflow With ChartRequest
At ChartRequest, we help healthcare organizations manage release of information and medical records retrieval. We can review your request path, outline the steps our team can handle, and identify exceptions your staff may still own.
Bring your current process and vendor questions to a workflow review. Compare the contract responsibilities with how the work would actually move, before making an operational change.
Schedule a ChartRequest workflow review.
Frequently Asked Questions
