HIPAA Business Associate Agreement Checklist

Before signing

• Confirm the vendor actually creates, receives, maintains, or transmits PHI on your behalf — if so, a BAA is required, not optional
• Confirm the BAA obligates the vendor to appropriately safeguard PHI and report breaches back to you
• Confirm the BAA's breach-notification timeline is fast enough to fit inside your own 60-day Breach Notification Rule obligation

Ongoing

• Maintain a real inventory of every vendor with a signed BAA — a vendor handling PHI without one is a real, common gap
• Review BAAs when a vendor relationship's scope changes, not just at initial signing
• Confirm sub-processors the vendor itself uses are also covered by an appropriate downstream BAA