BAA Tracking: The Countersignature Is the Easy Part

The BAA is the most-tracked document in healthcare vendor compliance and one of the least verified.

Almost every organization can tell you whether a business associate agreement exists for a given vendor. Very few can tell you whether that agreement contains the provisions the rule requires, whether it reaches the vendor's subcontractors, or whether a single obligation inside it has ever been performed. The countersignature became the metric because it is the one thing a shared drive can answer.

What the rule requires in the document

45 CFR 164.504(e) is specific about contents, and it is worth reading against your own template rather than assuming your template was right when it was written.

The agreement has to establish the permitted and required uses and disclosures of protected health information. It has to require appropriate safeguards, and require the business associate to report unauthorized uses and disclosures, including breaches of unsecured PHI. It has to require that subcontractors who receive PHI agree to the same restrictions and conditions. It has to provide for access and amendment, and require the business associate to make available the information needed to produce an accounting of disclosures - the accounting itself remains yours to produce. It has to make the business associate's internal practices, books and records available to the Secretary, and note the limit on that clause: it is for determining your compliance, not as a general audit right for you. Where the business associate carries out one of your obligations under the Privacy Rule, it has to comply with the requirements that would apply to you. It has to require return or destruction of PHI at termination where that is feasible, with continued protection where it is not. And it has to authorize you to terminate if you determine the business associate has violated a material term, which is 164.504(e)(2)(iii) and the provision vendor-drafted forms most often soften into a mutual right.

Two qualifications. 164.504(e)(3) provides other arrangements for some relationships, including a memorandum of understanding between government entities, so the contents list is not universal. And for electronic PHI the requirements run in parallel: 45 CFR 164.308(b) makes the written contract an administrative safeguard in its own right, and 45 CFR 164.314(a)(2) sets its contents. One of those is broader than its Privacy Rule counterpart. The business associate must report "any security incident of which it becomes aware," which is a wider trigger than reporting uses and disclosures the contract did not permit. A template checked only against 164.504(e) can pass and still be missing it.

Two failure modes follow from that list. The first is a template written against the pre-2013 requirements. The Omnibus Rule at 78 FR 5566 took effect on 26 March 2013 with a compliance date of 23 September 2013, and 164.532(e) deemed older contracts compliant only until they were renewed or modified after that date, or 22 September 2014 at the outside. Any BAA whose language has not been touched since then is running on a superseded form. Those requirements have not moved since: 164.504(e) and 164.314(a) were last amended in January 2013. The second failure mode, more common now, is a vendor's own BAA form accepted under time pressure during onboarding, which may be lawful and may still be missing a provision you would have wanted.

The subcontractor problem

45 CFR 164.502(e) extends the obligation downward, and it does not stop. A business associate that hands PHI to a subcontractor must obtain satisfactory assurances in writing carrying the same restrictions; 160.103 makes that subcontractor a business associate in its own right; and 164.504(e)(5) applies the same contract requirements to that relationship. The recursion has no floor. The rule's drafters said so when they were asked, writing that covered entities must obtain assurances from their business associates and business associates must do the same with subcontractors, "no matter how far 'down the chain' the information flows."

Now the part most programs get backwards, in the direction of assuming they are in worse shape than they are. You are not required to reach down. 164.502(e)(1)(i) says a covered entity "is not required to obtain such satisfactory assurances from a business associate that is a subcontractor," and 164.308(b)(1) repeats it word for word for electronic PHI. Your obligation runs to your direct business associate, and a conforming BAA discharges it. The downstream assurances are your vendor's duty to obtain, not yours to hold.

So the honest statement of the problem is not that you are non-compliant. It is that compliance and knowledge part company here. You hold a countersigned BAA with your transcription vendor. That vendor uses a cloud storage provider and a coding subcontractor, both of which touch PHI. Your evidence that either is covered is a sentence in your agreement saying they will be. Ask for the downstream agreements and the usual answer is that the vendor confirms it has them, which is worth what any unverified attestation is worth.

Whether that is worth chasing is a judgment about your own exposure rather than a compliance question. Two things narrow it. Under 164.504(e)(1)(ii) you are out of compliance if you knew of a pattern of material breach and did not cure or terminate, so knowledge you do have creates a duty to act. And under 45 CFR 160.402(c)(1) you are liable for a civil money penalty for the acts of an agent acting within the scope of the agency, business associates included, under the federal common law of agency. Neither turns into a requirement to collect downstream paper. Both are reasons the answer might matter to you anyway.

One boundary worth knowing before you go looking: a subcontractor is someone the business associate delegates work to "other than in the capacity of a member of the workforce," and workforce reaches anyone under the vendor's direct control, paid or not. Contract and offshore staffing is exactly where that line falls. Personnel working under your vendor's direct control are its workforce, and no downstream agreement is required for them.

Where BAAs drift

A BAA is signed once and then the world moves around it, in ways that are individually mundane.

The vendor is acquired, and the entity named as business associate no longer exists in the form you contracted with. The service scope expands - a reporting module gets added, and suddenly PHI flows somewhere the original agreement did not contemplate. A subcontractor is swapped for a cheaper one, with no notice to you because your agreement did not require notice, only assurances. The vendor's own security program changes after a reorganization. Someone on your side grants a new integration access that widens the data set.

None of that invalidates the document. All of it widens the distance between what the document assumes and what is happening, which is compliance drift in its most ordinary form.

What tracking should mean

Storage is not tracking. A folder of executed BAAs answers one question - does a document exist - and the rule asks several.

Real tracking starts from the clause. For each vendor: does the executed agreement contain each provision 164.504(e) requires, or is one missing? Does the named business associate match the entity actually performing? Which subcontractors touch PHI, and can you show that your vendor obtained the downstream assurances rather than just promising they exist? You are not required to hold those agreements, so treat this as diligence rather than as a finding. When the vendor reported an incident, was it within the window the agreement specifies? At the last termination, was PHI returned or destroyed, and what evidences that?

Every one of those is answerable from documents. None of them is answerable from a signature block.

How Harper handles it

Harper reads the executed BAA and the underlying services agreement together, because the obligations interact - the BAA sets the data terms and the services agreement usually sets the insurance, notice and subcontracting terms that determine how the data terms get enforced.

Each provision becomes a tracked item with the clause it came from. Missing required provisions surface as gaps rather than as a green checkmark. Subcontractor disclosure becomes a standing request to the vendor, chased to an answer, with the downstream agreements collected as evidence rather than asserted. Incident-reporting windows become parameters something can test against when an incident actually happens. Termination obligations survive offboarding, because the item persists after the vendor disappears from the vendor list.

And because the same required provisions recur across every BAA you hold, they are stored once and matched against each agreement, so the two hundredth BAA is cheaper to review than the first.

A test worth running on ten files

Pull ten BAAs at random and answer four things.

1. Does each one contain a provision requiring subcontractors to agree to the same restrictions?
2. Does the named business associate match the legal entity currently invoicing you?
3. For any vendor you know uses subcontractors with PHI access, can you show the vendor obtained downstream written assurances? The rule does not require you to hold them, so this is a diligence question rather than a compliance gap.
4. For the most recent vendor you offboarded, what evidences that PHI was returned or destroyed?

Question 1 usually passes, because it is in most templates. Question 3 is where the program's real depth shows, and question 4 is the one nobody has, because the vendor was removed from the system that would have tracked it.