The Business Associate Agreement is the contract through which an EHR vendor accepts HIPAA obligations for the patient data in their platform. Most home health agencies sign whatever BAA the vendor provides without review, on the assumption that the vendor's legal team has produced a compliant document. Some have. Many have produced a document that's HIPAA-compliant in the minimum required sense while containing provisions that are significantly unfavorable to the covered entity — particularly around breach notification timelines, liability limitations, and sub-contractor coverage. The gap between a standard vendor BAA and a negotiated BAA often means the difference between meaningful protection and an expensive surprise when a breach occurs.
What HIPAA Requires a BAA to Include — the Baseline
HIPAA specifies the minimum required provisions for a BAA at 45 CFR § 164.504(e). These include: permitted and required uses of PHI, prohibitions on unauthorized uses, requirements to use appropriate safeguards, reporting of security incidents and breaches, requirements to flow down obligations to sub-contractors (sub-business-associates), obligations at termination of the arrangement, and authorization for the covered entity to terminate the agreement if the BAA is breached. A BAA that contains all of these provisions is technically HIPAA compliant. It may still be a poor agreement for the agency — see HIPAA Security Officer Requirements for Home Health Agencies for how BAA review and negotiation fits into the Security Officer's broader vendor management responsibilities.
What Standard Vendor BAA Templates Commonly Omit or Underspecify
Breach Notification Timeline
HIPAA requires a BAA to include breach notification provisions, but doesn't specify an exact notification timeline for the business associate to notify the covered entity. Standard vendor BAAs often use language like "without unreasonable delay" or "within 60 days of discovery" — the latter being the maximum HIPAA permits for notification to patients, not the standard for business-to-business notification. This matters enormously: the agency's own 60-day notification clock to OCR and patients starts at the agency's discovery of the breach, not the vendor's. If an EHR vendor takes 45 days to notify the agency of a breach in their system, the agency has 15 days to identify affected patients, send letters, and notify HHS. Negotiate for a specific business-to-business notification timeline of 5–15 days maximum.
Sub-Contractor Coverage and Cloud Infrastructure
An EHR vendor doesn't operate in isolation. They use cloud infrastructure providers (AWS, Azure, Google Cloud), backup vendors, analytics platforms, and support services — all of which may process patient data. The BAA should require the vendor to flow down HIPAA obligations to all sub-contractors and to notify the agency if a sub-contractor breach affects its data. Standard templates often contain this requirement in general language without specifying that the vendor is responsible for the sub-contractor's compliance or for notifying the agency of sub-contractor incidents. This same sub-contractor logic applies to any vendor touching ePHI — see Home Health EHR Security Compared for how BAA boundaries specifically play out across the major home health EHR platforms.
Security Standards and Evidence
Standard BAAs state that the vendor will "use appropriate safeguards" to protect PHI. Negotiate for the vendor to specify the security standards they maintain — SOC 2 Type 2 certification, HITRUST, or equivalent — and to provide annual evidence of continued certification. A vendor that won't commit to documented security standards in the BAA is a vendor whose security posture can't be verified.