Domain H: Business Associate & Subcontractor Management
Signed BAAs before any PHI moves: a covered entity obtains assurances from every business associate, a business associate flows the same restrictions down to its subcontractors.
Some items in this domain are written for one entity type. Items marked Business Associates only or Covered Entities only apply to that type; unmarked items apply to every HIPAA-regulated organization.
Every item here is already part of the current, final HIPAA Security Rule. Items marked NPRM: would become Required are currently Addressable, OCR’s pending 2025 proposed rule would eliminate that flexibility and make them mandatory if finalized (not yet in effect).
Signed BAA on file for every covered-entity relationship
45 C.F.R. §164.504(e) · Source: www.ecfr.gov/current/title-45/section-164.504
Signed BAA on file for every downstream subcontractor with PHI access
45 C.F.R. §164.308(b)(1); 164.502(e)(1)(ii) · Source: www.ecfr.gov/current/title-45/section-164.308
Subcontractor BAAs flow down the same restrictions the organization itself received
45 C.F.R. §164.504(e)(1)(ii) · Source: www.ecfr.gov/current/title-45/section-164.504
Vendor security due-diligence process performed before onboarding a subprocessor
45 C.F.R. §supports 164.308(a)(1) scope · Source: www.ecfr.gov/current/title-45/section-164.308
Active subcontractor BAAs and their security posture reassessed on a periodic cycle
45 C.F.R. §supports 164.308(a)(1) scope · Source: www.ecfr.gov/current/title-45/section-164.308
Every vendor that creates, receives, maintains, or transmits PHI on the organization's behalf is identified as a business associate and recorded in the BAA tracker before any PHI is shared
45 C.F.R. §160.103; 164.502(e)(1) · Source: www.ecfr.gov/current/title-45/section-164.502
Signed Business Associate Agreement containing every required element on file with each business associate before PHI is disclosed to it, documenting the satisfactory assurances the Privacy Rule requires
45 C.F.R. §164.502(e); 164.504(e)(2) · Source: www.ecfr.gov/current/title-45/section-164.502
Due diligence on a business associate's safeguards performed before contracting and repeated on a periodic cycle for those that hold or process ePHI
45 C.F.R. §supports 164.308(a)(1) scope; 164.308(b) · Source: www.ecfr.gov/current/title-45/section-164.308
A known material violation of a BAA by a business associate is cured or the arrangement terminated where feasible, and the steps taken are documented
45 C.F.R. §164.504(e)(1)(ii) · Source: www.ecfr.gov/current/title-45/section-164.504
Security requirements are applied when acquiring information technology systems and services
45 C.F.R. §164.308(a)(1) · Source: www.ecfr.gov/current/title-45/section-164.308
A named coordinator measures business associate performance and re-checks the business associate list for completeness
45 C.F.R. §164.308(b)(1) · Source: www.ecfr.gov/current/title-45/section-164.308