Business associate and qualified service organization agreements

Reference article · 5 min read

A vendor sends its own one-page business associate agreement, already signed, and asks the agency to countersign so work can start. It promises to safeguard protected health information and report breaches. It rarely says how fast, to whom, what happens to the data at termination, whether subcontractors are bound, or whether the vendor knows that some records it will hold come from a substance use disorder program and carry separate rules.

Two frameworks are at work, and they are often confused. HIPAA governs protected health information held by covered entities and by the business associates handling it on their behalf. The federal confidentiality rules at 42 CFR Part 2 govern records from federally assisted substance use disorder programs, and they reach vendors through a qualified service organization agreement. A vendor that needs both does not satisfy Part 2 by signing a BAA.

Deciding which agreement applies

Start with the data, not the vendor category.

A business associate agreement is needed when the agency, as a covered entity or as a business associate to another entity, gives a vendor protected health information to perform a function or service on the agency's behalf. Storage counts. So does access the vendor could use, even if it says it does not look.
A qualified service organization agreement is needed when a Part 2 program discloses patient identifying records to an outside entity providing a service to the program: data processing, billing, hosting, accounting, legal, laboratory, or similar professional services.
Both is the common answer in county and state behavioral health, where a Part 2 program sits inside a larger covered entity and one platform holds both kinds of records. A combined document works if it carries the full substance of each, not a Part 2 sentence bolted onto a HIPAA template.
Neither is uncommon, and usually rests on a claim worth testing: that the data is properly de-identified, or that the people involved are workforce members under agency supervision.

Agencies with hybrid entity status should confirm which components fall inside the designated health care component.

What a business associate agreement must actually say

Vendor templates restate the regulation and stop there. Ask for terms the agency can enforce.

Permitted uses, stated narrowly. No use for product improvement, benchmarking, research, marketing, or model training unless the agency approves it in writing and the law allows it.
Subcontractor flow-down. Written agreements at least as protective, a named list of subcontractors, advance notice before one is added, and disclosure of where data rests and who can reach it offshore.
Breach reporting on the agency's clock. Federal rules allow an outer limit measured in weeks after discovery. That is a ceiling, not a service level. Agencies commonly require notice of a suspected incident within hours, a written report with defined content soon after, and allocation of notification costs.
Return or destruction at termination. A deadline, a usable export format, a certificate of destruction, and explicit coverage of backups. If return is infeasible, protections must extend to whatever remains, indefinitely.
Audit and individual rights support. Inspection, current third-party assessment summaries, a remediation duty, and cooperation on access, amendment, and accounting of disclosures within timeframes that let the agency meet its own.

What a qualified service organization agreement adds

A QSOA is short but specific. Its core is an acknowledgment the vendor cannot soften: in receiving, storing, processing, or otherwise dealing with patient records it is fully bound by Part 2, and it will resist in judicial proceedings any effort to obtain those records except as the rules permit. Beyond that, require:

Segregation or clear labeling of Part 2 records so they are not swept into routine disclosures.
A bar on redisclosure without consent or a qualifying court order, with the required notice accompanying any permitted disclosure.
Limits on use of the records in civil, criminal, administrative, or legislative proceedings against a patient.
Security and breach terms matching the agency's BAA.

Recent federal rulemaking has aligned Part 2 more closely with HIPAA on consent, breach notification, and enforcement. Confirm current requirements and compliance dates with counsel before reusing an older template.

The vendors agencies skip

Cloud hosting, backup, and disaster recovery. Persistent storage of protected health information makes a vendor a business associate. Encryption alone does not change that.
AI transcription, summarization, and analytics tools. Ask what happens to inputs and outputs, whether human reviewers see them, and whether anything is retained for model development.
Interpreters, translators, and transcriptionists, who hear clinical detail routinely.
Shredding, scanning, and offsite records storage. Physical handling is handling.
Fax, messaging, scheduling, and contact center platforms, plus consultants and temporary staff with production access.

Over-claims worth pushing back on

The conduit exception is narrow. It covers entities that merely transmit information and store it only transiently in transit, closer to a courier than a data center. A vendor holding data at rest does not qualify. Treat these with equal care: "we are encrypted and hold no keys," "we only see metadata," "our data is de-identified" with no named method or expert basis, and "our certification replaces a BAA." A certification is evidence about controls, not a contract.

How to start

Inventory every vendor that stores, transmits, views, or disposes of health and human services data, including named subcontractors.
Record whether each touches Part 2 records and sits inside the covered component.
Publish an agency-standard BAA and QSOA rider in the solicitation, so terms are settled before award rather than under schedule pressure.
Have counsel review the templates on a fixed cycle as requirements change.

HQT builds and supports systems for state and local agencies that handle sensitive health and human services data, including the hosting, integration, and access control questions these agreements raise.

Frequently asked questions

Does a cloud hosting or backup vendor need a business associate agreement?

Yes, in almost every case where the vendor stores protected health information, even briefly at rest. Encryption and a claim that the vendor holds no keys do not remove the requirement, because the vendor still maintains the data. The conduit exception applies only to entities that transmit information and store it transiently as part of that transmission.

Can one combined document serve as both a BAA and a qualified service organization agreement?

Yes, if the combined document carries the full substance of each rather than adding a single Part 2 sentence to a HIPAA template. It must include the Part 2 acknowledgment that the vendor is fully bound by those rules and will resist judicial efforts to obtain the records except as permitted. Many agencies use a standard BAA with a Part 2 rider attached so language stays consistent across contracts.

What should we push back on when a vendor sends its own one-page BAA?

Look first for the terms vendor templates usually omit: narrow permitted uses that exclude analytics and model training, subcontractor flow-down with a named list, a breach notification clock measured in hours rather than the federal outer limit, return or destruction of data at termination including backups, and audit and evidence rights. Add allocation of notification costs and support for individual rights requests on timeframes the agency can meet. It is easier to publish an agency-standard form in the solicitation than to renegotiate after award.

Do AI transcription and analytics vendors need a BAA?

If they receive, process, or store protected health information on the agency's behalf, yes. The added questions for these tools concern what happens to inputs and outputs: whether human reviewers see the data, how long it is retained, and whether it is used to train or improve models. Agencies generally prohibit secondary use in writing rather than relying on a vendor privacy policy, which the vendor can change.

Who decides whether our data is covered by 42 CFR Part 2?

Coverage depends on whether the records come from a federally assisted program that holds itself out as providing substance use disorder diagnosis, treatment, or referral, not simply on whether the data mentions substance use. Because that determination affects consent, redisclosure, and vendor agreements, agencies should make it with counsel and document it. Requirements have been amended in recent federal rulemaking, so confirm the current text before relying on older guidance.