A business associate management program is the inventory, contract checks, procedures and records a HIPAA covered entity uses to show that each business associate is bound by a written agreement meeting 45 CFR 164.504(e), and to act when a vendor breaches it. Integral Healthcare Solutions (IHS) drafts the program for your counsel to adopt. IHS is a consulting firm, not a law firm, and this page is not legal advice.
Last updated: November 2026
What must a business associate agreement contain under 45 CFR 164.504(e)?
Section 164.502(e) lets a covered entity disclose protected health information to a business associate if it obtains satisfactory assurance that the business associate will appropriately safeguard it, documented through a written contract or other written agreement or arrangement that meets the applicable requirements of 164.504(e). A covered entity need not obtain it from a subcontractor business associate; a business associate obtains it from its own subcontractor (164.502(e)(1)(ii)).
Text read: eCFR, 45 CFR 164.502, 164.504, 164.308, 164.314, 164.410 and 160.103, current through the Title 45 amendment date of November 3, 2026 (opened November 5, 2026): 164.504 on eCFR.
| Paragraph | What the contract must do, in IHS's words |
|---|---|
| 164.504(e)(2)(i) | Set the business associate's permitted and required uses and disclosures. It may not authorize any that would violate the subpart if the covered entity did them, except the business associate's proper management and administration (e)(4) and data aggregation for the covered entity's health care operations. |
| (e)(2)(ii)(A)-(C) | No use or further disclosure except as the contract permits or requires or as law requires; appropriate safeguards and, where applicable, subpart C compliance for electronic information; report any use or disclosure not provided for by the contract of which the business associate becomes aware, including breaches of unsecured protected health information under 164.410. |
| (e)(2)(ii)(D) | Subcontractors handling the information on its behalf agree to the same restrictions and conditions, in accordance with 164.502(e)(1)(ii). |
| (e)(2)(ii)(E)-(I) | Support access (164.524), amendment (164.526) and accounting (164.528); to the extent it carries out the covered entity's obligation, comply with the requirements that apply to the covered entity; make books and records available to the Secretary. |
| (e)(2)(ii)(J) | At termination, if feasible, return or destroy all of the information it still maintains in any form and keep no copies; if that is not feasible, extend the contract's protections to it and limit further uses and disclosures to the purposes that make return or destruction infeasible. |
| (e)(2)(iii) | Authorize the covered entity to terminate if it determines the business associate has violated a material term. |
Under 164.504(e)(1)(ii), a covered entity is not in compliance if it knew of a pattern of activity or practice of the business associate that constituted a material breach or violation of the business associate's obligation under the contract, unless it took reasonable steps to cure the breach or end the violation and, if those steps were unsuccessful, terminated the contract or arrangement, if feasible.
For electronic protected health information, 164.308(b) and 164.314(a)(2)(i) require a contract providing that the business associate will comply with the applicable subpart C requirements, ensure its subcontractors that handle the information agree to comply, and report any security incident of which it becomes aware, including breaches of unsecured protected health information.
Under 164.410, except as provided in 164.412, a business associate must notify the covered entity of a breach of unsecured protected health information without unreasonable delay and in no case later than 60 calendar days after discovery. Discovery is the first day the breach is known to the business associate or, by exercising reasonable diligence, would have been known; the knowledge of its employees, officers and other agents (determined under the Federal common law of agency), other than the person committing it, counts.
These sections set contract terms and a duty to act on a known pattern of material breach. They do not require an inventory, tracking system or annual review; those parts of a program are IHS method.
Who is a business associate, and is a cloud provider one?
Under 45 CFR 160.103, and except for the paragraph (4) exclusions (for example, a provider receiving treatment disclosures), a business associate is a person who, on behalf of a covered entity (or of an organized health care arrangement it participates in), other than as a workforce member, creates, receives, maintains or transmits protected health information for a function or activity the subchapter regulates, or who provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial services to or for the covered entity where the service involves disclosure of protected health information from the covered entity or another of its business associates to that person. Subcontractors that handle the information for a business associate are included.
HHS cloud guidance says a cloud provider that maintains electronic protected health information for a covered entity or business associate is a business associate even if it stores only encrypted data and lacks the key, and limits the conduit exception to transmission-only services, including temporary storage incident to transmission (HHS guidance, opened November 5, 2026).
Who needs a business associate management program and what triggers it?
A covered entity needs satisfactory assurances, documented in a written contract or other written arrangement meeting 164.504(e), from each vendor that is a business associate, and a business associate needs them from each subcontractor that is a business associate.
- In IHS's reading: many vendors and no inventory, tracking or written onboarding and offboarding procedure.
- A known pattern of vendor breach, for which 164.504(e)(1)(ii) requires reasonable steps to cure the breach or end the violation and, if those fail, termination if feasible.
- The MedEvolve resolution agreement, signed March 17, 2023, began with a report that an FTP server holding protected health information of 230,572 individuals had been unsecure and accessible on the internet. HHS's investigation indicated that MedEvolve, a business associate, failed to enter into a business associate agreement with a subcontractor. The payment was 350,000 dollars, and the agreement is not an admission of liability (opened November 5, 2026).
- HHS says OCR can take enforcement action against business associates only for the requirements it lists, including breach notification to a covered entity or another business associate and agreements with subcontractors (HHS fact sheet, last reviewed July 16, 2021; opened November 5, 2026).
What does the 2025 Security Rule proposal change for business associates?
It would add annual written verification and a 24-hour contingency-plan report, but it is only a proposed rule: 90 FR 898, January 6, 2025, RIN 0945-AA22, comments due on or before March 7, 2025 (Federal Register notice, opened November 5, 2026).
- Proposed 164.308(b)(2)(ii): written verification from the business associate at least once every 12 months that it has deployed the technical safeguards in 164.312, through both a written analysis of its relevant systems by a qualified person and a written certification, by a person with authority to act for it, that the analysis was performed and is accurate.
- Proposed 164.314(a)(2)(i)(D): the contract would provide that the business associate reports activation of its contingency plan without unreasonable delay and no later than 24 hours after activation.
We did not confirm whether HHS has acted since; check the Federal Register under the RIN before planning around it.
How IHS helps
IHS runs five steps: a gap assessment of vendor files against 164.504(e); a map of vendors, contracts and data flows; drafting of missing program documents; a mock review of a sample of agreement files; and readiness support. IHS drafts a vendor inventory with a business-associate status field, an agreement checklist keyed to 164.504(e)(2), onboarding and offboarding procedures, a breach-escalation procedure, a tracking log and a review calendar; the inventory, log and calendar are IHS method.
You supply the vendor list, executed agreements, counsel's approval of language and each vendor's status decision. The real limit: your counsel approves agreement language and decides business associate status; IHS gives no legal advice and does not contact your vendors or any regulator.
IHS was founded in 2002 and is led by Thomas G. Goddard, JD, PhD, former Chief Operating Officer and General Counsel of URAC. This program is in IHS's compliance services line; IHS also does accreditation consulting and program development.
What to have ready
- A list of vendors that handle protected health information, and who decided each is or is not a business associate (164.502(e)(1)).
- Every executed business associate agreement or other written arrangement (164.502(e)(2)).
- How each vendor reports misuse and breaches to you, and its time limit (164.504(e)(2)(ii)(C), 164.410).
- Which vendors use subcontractors, and their agreements (164.504(e)(2)(ii)(D), (e)(5)).
- Return or destruction terms, and any offboarding completed (164.504(e)(2)(ii)(J)).
- Any vendor problem you knew of, and your steps (164.504(e)(1)(ii)).
The free introductory call is where IHS learns what you have.
How it compares
Template agreements alone, a management program, outside counsel reviewing each agreement and a vendor-risk software platform are four routes, and they can be combined. In IHS's reading, a template does not show which vendors you have or whether an agreement was signed.
Related: Security Rule risk analysis, breach notification response, right of access, the Privacy Rule compliance program build and compliance services.
What does a business associate management program cost?
The sections we read attach no government fee to having a program. IHS does not publish a price for this work and scopes each engagement after a free introductory call. In IHS's reading, scope depends on the number of vendors and whether an inventory and signed agreements exist.
What this is not
- It is not legal advice and does not decide whether a vendor is a business associate.
- It is not contract drafting or approval; your counsel supplies and approves the language.
- It is not vendor outreach or regulator contact.
Frequently asked questions
What must a business associate agreement contain?
Under 164.504(e)(2), the contract must set the business associate's permitted and required uses and disclosures and carry the terms in the table above, including termination authority for the covered entity.
Do subcontractors need agreements too?
Yes, where the subcontractor is itself a business associate. Section 164.502(e)(1)(ii) lets a business associate share protected health information with a subcontractor if it obtains satisfactory assurances, and 164.504(e)(5) applies the contract requirements to that agreement.
What must we do if a vendor breaches?
A covered entity that knew of a pattern of activity or practice of the business associate that constituted a material breach or violation must have taken reasonable steps to cure the breach or end the violation and, if those steps were unsuccessful, terminated the contract or arrangement, if feasible (164.504(e)(1)(ii)).
What happens to protected health information when the contract ends?
If feasible, the business associate returns or destroys all of it that it still maintains in any form and keeps no copies; if not, the contract's protections extend to it and further uses are limited to the purposes that make return or destruction infeasible (164.504(e)(2)(ii)(J)).
Is a cloud provider that stores only encrypted data a business associate?
HHS cloud guidance says yes: a cloud provider that maintains electronic protected health information for a covered entity or business associate is one even if it lacks the key. The conduit exception is limited to transmission-only services.
How fast must a business associate report a breach to us?
Except as provided in 164.412, without unreasonable delay and in no case later than 60 calendar days after discovery of a breach of unsecured protected health information (164.410(b)). In IHS's reading, your contract can ask for less time.
Do we need a vendor inventory?
The sections quoted here do not require an inventory, tracking system or annual review. In IHS's reading, an inventory with a business-associate status field shows which vendor contracts the rule reaches.
Does the 2025 Security Rule proposal require annual verification from business associates?
Not today. The proposal would require a covered entity to obtain written verification from a business associate at least once every 12 months that it has deployed the technical safeguards in 164.312. Check the Federal Register under RIN 0945-AA22 for later action.