OCR Vendor Business Associate Agreement: Who Needs One?
By Schema LawPublished Updated
Your firm needs a business associate agreement with an OCR vendor when the firm is itself a business associate, meaning it received the medical records from a hospital, provider or health plan it works for. A firm that holds a client's own records under a signed authorization falls outside that definition, though other duties still apply.
The answer turns on how the records reached you, not on what they contain. This post walks through the HIPAA definitions that decide it, quoted from the regulations, and then through the contract itself. It explains how to handle documents. It is not legal advice, and state health privacy law may add to everything here.
What is a business associate agreement, and who has to sign one?
A business associate agreement is the written contract the HIPAA rules require before a covered entity lets an outside person or company handle protected health information on its behalf. The covered entity and the business associate sign it. A business associate that passes the information to its own subcontractor needs the same kind of contract with that subcontractor.
Three definitions in 45 CFR 160.103 carry the weight.
| Term | What the regulation says |
|---|---|
| Covered entity | "(1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter." |
| Business associate | A person who, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information" for a regulated function, or who provides one of a list of services to a covered entity where the service involves disclosure of protected health information to that person |
| Subcontractor | "a person to whom a business associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate" |
The duty to have a contract comes from 45 CFR 164.502(e). Paragraph (e)(1)(i) lets a covered entity disclose protected health information to a business associate "if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information." Paragraph (e)(2) says those assurances "must be documented through a written contract or other written agreement or arrangement with the business associate that meets the applicable requirements of § 164.504(e)."
The Department of Health and Human Services uses the short name. Its business associates guidance describes the satisfactory assurances as taking "the form of a contract or other written arrangement (collectively referred to as a 'business associate agreement,' or BAA)". The same page notes that a business associate "is also directly liable for complying with certain provisions of the HIPAA Rules." So the agreement is not the only source of a business associate's obligations.
Is a law firm a business associate when it holds medical records?
A law firm is a business associate when it provides legal services to a covered entity and that work involves the covered entity disclosing protected health information to the firm. A firm that acts for the patient, or for a party that is not a covered entity, does not meet that definition merely by holding medical records.
Legal services are named in the regulation. Paragraph (1)(ii) of the definition in 45 CFR 160.103 covers a person who provides "legal, actuarial, accounting, consulting, data aggregation", management, administrative, accreditation or financial services "to or for such covered entity", "where the provision of the service involves the disclosure of protected health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person." The HHS guidance page lists as an example an "Attorney whose legal services to a health plan involve access to PHI."
Read the definition as two tests. Who is the client, and where did the records come from?
| Situation | Client a covered entity? | Records disclosed by that client for the legal work? | Business associate on the face of the definition? |
|---|---|---|---|
| Defending a hospital in a malpractice claim, using the hospital's chart | Yes | Yes | Yes |
| Advising a health plan on a coverage dispute, using its claim files | Yes | Yes | Yes |
| Representing an injured person, with records obtained on that person's authorization | No | No | No |
| Defending a trucking company, with the plaintiff's records obtained by subpoena | No | No | No |
| Representing a hospital in a lease negotiation, with no patient information involved | Yes | No | No, for that work |
The table shows how the wording reads. It does not decide your case. A firm with a health care practice may be a business associate for some matters and not for others, and one matter can hold records from both kinds of source. Check your engagement terms: if the firm signed a business associate agreement with a client, that contract governs what the firm may do with that client's records, including whether and how it may use outside services.
Records can also fall outside the rules by definition. The regulation's definition of protected health information excludes "employment records held by a covered entity in its role as employer" and education records covered by the Family Educational Rights and Privacy Act. School files have a federal rule of their own, covered in the post on OCR for student education records.
Does an OCR vendor become a subcontractor business associate of the firm?
Yes, when the firm is a business associate and the OCR vendor receives or keeps the protected health information to do work the firm has handed off. The definition of business associate expressly includes "a subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate."
The chain has three links.
- Covered entity to firm. The hospital discloses a chart to its outside counsel under a business associate agreement.
- Firm to vendor. Counsel uploads the scanned chart to an online OCR service to make it searchable. The firm has delegated a function, and the vendor receives and maintains the pages while it does so.
- Vendor to its own suppliers. If the vendor passes the pages to another company, the same question repeats one level down.
At the second link the firm takes on the covered entity's role. Under 45 CFR 164.502(e)(1)(ii), a business associate may disclose protected health information to a subcontractor "if the business associate obtains satisfactory assurances, in accordance with § 164.504(e)(1)(i), that the subcontractor will appropriately safeguard the information." The hospital does not contract with the OCR vendor. The firm does. Paragraph (e)(1)(i) of the same section says a covered entity "is not required to obtain such satisfactory assurances from a business associate that is a subcontractor."
HHS has addressed online services directly in its guidance on HIPAA and cloud computing. It says: "when a business associate subcontracts with a CSP to create, receive, maintain, or transmit ePHI on its behalf, the CSP subcontractor itself is a business associate." CSP is the guidance's abbreviation for cloud service provider.
Two arguments a firm might be tempted to make are answered in that guidance.
"The vendor only holds the file for a few minutes." The guidance describes a narrow conduit exception "limited to transmission-only services", where any storage is temporary and "incident to such transmission". A service that receives a file in order to process it is doing more than carrying it from one place to another. If you think a tool fits the exception, get advice before relying on it.
"The file is encrypted, so the vendor cannot read it." The guidance says the cloud provider is a business associate "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data." An OCR service has to read the page to convert it, so this point matters less for conversion than for storage, but it closes the door on encryption as a substitute for the contract.
The consequence is stated plainly: "If a covered entity (or business associate) uses a CSP to maintain (e.g., to process or store) electronic protected health information (ePHI) without entering into a BAA with the CSP, the covered entity (or business associate) is in violation of the HIPAA Rules."
Medical records a firm holds outside the business associate rules
Medical records that reach a firm on the patient's own authorization, or through a subpoena or discovery in a case where the firm's client is not a covered entity, are held outside the business associate rules as the definition reads. HIPAA requires no agreement with an OCR vendor for them. Other limits still decide whether you may upload them.
Records obtained on the client's authorization
A plaintiff's firm asks a clinic for its client's chart and sends a signed authorization. Under 45 CFR 164.508(a)(1), a covered entity "may not use or disclose protected health information without an authorization that is valid under this section", except as the rules otherwise allow, and when it has one, "such use or disclosure must be consistent with such authorization." The clinic is the regulated party in that exchange. The firm is the patient's lawyer. It provides no service to the clinic.
What still applies:
- Your confidentiality rule. The records are information relating to the representation, and the duty to protect them does not depend on HIPAA.
- The client's instructions. A client who signed an authorization for you to receive records has not thereby agreed to every tool you might use on them.
- State law. State medical privacy law may apply, and some categories of record carry separate federal or state rules. Check which apply to the records in front of you.
Records obtained by subpoena or in discovery
A defense firm whose client is not a covered entity receives the plaintiff's records from a hospital under a subpoena. 45 CFR 164.512(e) is the provision the hospital relies on to release them, and it shapes what arrives with the records. One route under that paragraph is a qualified protective order, which paragraph (e)(1)(v) defines as an order or stipulation that:
- "Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested"; and
- requires "the return to the covered entity or destruction of the protected health information (including all copies made)" when the litigation ends.
Those two terms bear directly on an OCR upload. A vendor that keeps copies after the case closes, or uses pages for anything beyond producing your export, would put the firm in breach of the order. Read the order before choosing a tool. The post on OCR for documents under a protective order covers vendor terms in that setting.
A mixed file
Suppose the fictional firm Calloway and Reyes defends Northgate Surgical Center, a covered entity, in an injury claim. The file holds Northgate's own chart for the patient, disclosed by the client, and records from an unrelated physiotherapy clinic obtained by subpoena. The first set came to the firm as Northgate's business associate. The second set did not. One upload of the whole folder to one tool treats both the same, so sort by source before converting.
Terms a business associate agreement with an OCR vendor must contain
A business associate agreement with an OCR vendor must contain the terms listed in 45 CFR 164.504(e)(2): permitted uses, a bar on other uses, safeguards, reporting of improper disclosures and breaches, the same terms for the vendor's subcontractors, access and accounting support, records open to HHS, return or destruction at the end, and a right to terminate.
45 CFR 164.504(e)(5) applies those requirements to a contract "between a business associate and a business associate that is a subcontractor in the same manner as such requirements apply to contracts or other arrangements between a covered entity and business associate." So the firm's agreement with the vendor is measured against the same list as the hospital's agreement with the firm.
| Subsection of 164.504(e)(2) | What the contract must do | What to look for with an OCR vendor |
|---|---|---|
| (i) | "Establish the permitted and required uses and disclosures" of the information | Use limited to converting the firm's documents and returning the output |
| (ii)(A) | Bar use or further disclosure "other than as permitted or required by the contract or as required by law" | No use for product improvement or model training |
| (ii)(B) | Require that the vendor "Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information" | A description of the safeguards, not only the word |
| (ii)(C) | Require a report of "any use or disclosure of the information not provided for by its contract of which it becomes aware, including breaches of unsecured protected health information" | A named contact and a time limit that lets the firm meet its own deadlines |
| (ii)(D) | Ensure that subcontractors "agree to the same restrictions and conditions" | The list of companies that touch the pages, and confirmation each has signed |
| (ii)(E) to (G) | "Make available protected health information in accordance with § 164.524", make it available "for amendment", and make available "the information required to provide an accounting of disclosures" | How the firm retrieves originals and outputs on request |
| (ii)(I) | Make "internal practices, books, and records" available to the Secretary | Present in the text, without conditions |
| (ii)(J) | At termination, "if feasible, return or destroy all protected health information" and "retain no copies" | Deletion of uploads, extracted text, exports and backups, with a stated period |
| (iii) | Authorize termination if the business associate "has violated a material term of the contract" | A right for the firm to end the contract on breach |
Three checks beyond the list.
Match it to the agreement you signed. Subsection (ii)(D) appears in the firm's own contract with the covered entity. If that contract is stricter than the regulation, for example on breach reporting time or on where data may be held, the vendor's agreement has to be at least as strict or the firm cannot keep its own promise.
Check which services the agreement covers. A vendor's agreement may apply to named products or configurations only. Google's help page on HIPAA compliance with Google Workspace and Cloud Identity, for example, ties its agreement to services on a list of included functionality. Confirm that the feature you plan to use is inside the agreement's scope.
Keep the signed copy. The regulation requires the assurances to be documented. Where a vendor has you accept its agreement in an admin console instead of signing a paper copy, save the text and the date of acceptance where the firm's vendor records live.
The agreement covers the firm's HIPAA position. It does not settle whether the output is right. Converting the records themselves, and checking names, dates and doses against the originals, is covered in the guide to OCR for medical records.
Charts and claim files often hold sensitive personal information beyond a diagnosis line. Health information privacy duties and the duty of confidentiality can both apply to the same upload. Read the breach notification sentence for a clock you can meet, and write the firm's contact into the matter note before the first page goes up.
When an OCR vendor will not sign a business associate agreement
When an OCR vendor will not sign a business associate agreement and your firm holds the records as a business associate, do not upload them to that vendor. The options left are a different vendor that will sign, software that runs on the firm's own equipment, or returning the conversion task to the covered entity client.
A vendor's refusal, or its silence, is an answer. Google's help page on HIPAA and its Workspace services puts the vendor's side of it bluntly: "Customers who have not signed a BAA with Google must not use PHI in Google Workspace or Cloud Identity services." Other vendors' terms may say the same in their own words. Search the terms of service for "protected health information" and "HIPAA" before you ask, because the terms may already forbid the upload.
Work through the options in this order.
- Confirm the firm's status for these records. If the records came on a patient's authorization and the firm is not a business associate for them, HIPAA does not require the agreement, and the decision moves to your confidentiality rule, the client's instructions and state law.
- Ask in writing. Send the vendor one question: will you sign a business associate agreement covering the conversion service on my plan? Keep the reply.
- Find a vendor that will. Look in a vendor's documentation for a statement that it offers the agreement, and for the services the agreement names.
- Convert on your own equipment. OCR software that runs entirely on a firm computer sends nothing to an outside company, so there is no subcontractor. The post on private OCR compares the ways to keep conversion in house.
- Ask the client. A hospital's records department may be able to supply text-searchable copies from its own systems.
- Do not split the difference. Uploading "only a few pages", or uploading under a personal account, changes nothing about the rule.
Schema Law's position
Schema Law's site states no HIPAA position. Its public pages do not mention HIPAA, protected health information or business associate agreements, and no plan lists one. Do not assume an agreement is available, and do not read a compliance claim into its four security commitments. If your firm is a business associate for a set of records, ask Schema Law in writing whether it will sign, and keep those records off the service unless a signed agreement is in place.
If the vendor receives legal process
An agreement also shapes what happens when someone else wants the records. Subsection (ii)(A) limits the vendor to disclosures the contract permits or the law requires. What a subpoena or warrant served on the vendor can reach, and whether you would hear about it, is covered in the post on subpoenas to an OCR vendor.