A HIPAA cloud business associate agreement checklist can help a healthcare practice see whether a provider’s promises are specific enough to support safe, dependable operations. The BAA matters, but it should not be reviewed in isolation: service-level terms, security documentation, and the practice’s own procedures also need to fit together.
This is general information, not legal advice. Have qualified legal and compliance professionals review the agreement for your practice. For context, HHS explains that a cloud service provider that maintains ePHI may be a business associate even when the information is encrypted and the provider does not hold the decryption key. Read HHS guidance on cloud services and ePHI.
Before signing: define what the provider will handle
Start by listing the information and systems the cloud service will touch. Identify whether the provider will store, process, transmit, back up, or support access to ePHI. Include connected services and support activities, not just the main application. A clear scope makes it easier to evaluate the agreement and identify responsibilities that may sit in other documents.
Then check that the BAA explains what the provider may do with the information and what it must not do. Look for terms addressing safeguards, permitted uses and disclosures, reporting of improper access or other security incidents, and cooperation with the practice when its obligations are affected. Avoid relying on a broad statement such as “we protect your data” without operational detail.
Make shared security responsibilities explicit
A cloud service does not automatically take every security task off the practice’s plate. The BAA and related documents should make it clear who handles each relevant control. Depending on the service, discuss:
- Access: Who manages user accounts, permissions, authentication settings, and access removal when a worker no longer needs it?
- Encryption: Which party configures encryption, manages keys, and addresses data in storage and while being transmitted?
- Administration: Who secures administrative tools, monitors access, and reviews security-relevant activity?
- Incident handling: How does the provider report suspected incidents, preserve relevant information, and cooperate with the practice’s investigation?
- Subcontractors: Which subcontractors may handle ePHI, and how does the provider ensure they are bound by appropriate protections?
Do not assume that a provider’s general claim of HIPAA compliance explains how your practice’s responsibilities are divided. The practice should understand its own responsibilities and consider the arrangement as part of its security risk analysis. NIST’s HIPAA Security Rule guidance can help frame that broader review.
Check backups and recovery in the service documents
A BAA may not describe the practical details you need to judge whether records can be restored after an outage, data loss, or security event. Review the service-level agreement and technical documentation alongside it. Confirm what is backed up, how often backups are made, how long copies are retained, and who is responsible for checking that the process works.
Ask how the provider tests restoration and what the practice should expect when requesting recovery. Clarify how the parties will coordinate, who can authorize a restore, and how the provider communicates progress. The contract should set understandable recovery expectations for the service, while your practice determines what interruption it can tolerate and plans accordingly.
It is useful to ask for evidence of restore testing rather than treating the existence of backups as proof that recovery will work. For a practical related checklist, see how to test a backup restore for critical files. For broader planning, review IT disaster recovery planning.
Agree on incident notice and cooperation
Ask the provider to state when and how it will notify your practice about a suspected or confirmed incident involving ePHI. The agreement should explain what events must be reported, where notices go, what information the provider will include, and how it will share updates as facts become available.
Ask for a specific notice deadline rather than relying on vague wording such as “promptly.” The practice needs enough information and time to assess the event, coordinate a response, and meet its own obligations. Also clarify who preserves logs or other relevant records, who answers follow-up questions, and whether the provider will help investigate and contain the issue. Have counsel assess the wording against the requirements that apply to your situation.
Review access, documentation, and service continuity
Check how your practice can access its records during normal service and when there is an outage, account problem, or disagreement about billing. Identify escalation paths and confirm that the agreement does not leave access to ePHI unclear during a dispute. Ask what happens if the cloud platform is unavailable and whether the provider has a defined process for communicating service interruptions.
Request security documentation that is useful for your review, such as descriptions of safeguards, incident processes, backup arrangements, and recovery testing. Audit access and documentation rights are not necessarily spelled out in every contract. Ask for review rights or suitable evidence based on your practice’s risk assessment rather than assuming a particular audit clause is automatic.
Plan for termination before it happens
The BAA should address what happens to ePHI when the relationship ends. Look for a process that explains:
- How the practice requests a complete export and what usable format it will receive.
- When the provider will return the information and whether export assistance is available.
- How long the practice can retrieve data during transition and who can access it.
- When the provider will delete remaining copies, including backups, and how it will confirm completion.
- What happens if the provider says some information cannot feasibly be returned or destroyed.
“Return or destroy” is not enough detail if the agreement leaves the timing, format, support, or retained copies unresolved. Make sure the BAA, service terms, and transition plan do not conflict. The practice should know how it will maintain access to records as it moves to another service or changes its systems.
Frequently asked questions
What should a HIPAA business associate agreement include?
It should clearly describe permitted uses and disclosures, safeguards, incident reporting, subcontractor responsibilities, cooperation with the practice, and what happens to ePHI when the agreement ends. Have qualified counsel assess whether the agreement fits your specific arrangement.
Does a cloud provider that stores encrypted ePHI need to sign a BAA?
HHS guidance says a cloud provider that maintains ePHI may be a business associate even if the data is encrypted and the provider cannot decrypt it. Confirm the facts of your arrangement with legal or compliance counsel.
What should the BAA say about backups and disaster recovery?
Check the BAA and related service documents for backup scope, retention, restore testing, responsibilities, recovery expectations, and communication during an outage. The contract should make clear who does what.
How quickly must a cloud provider notify a practice about a breach?
Ask the provider to specify its notice deadline, what events trigger notice, and what information it will supply. Have counsel check the terms against the requirements that apply to your practice.
Can a provider block access over a billing dispute, and what happens to ePHI when service ends?
Review the contract for access protections during disputes and a defined transition process. It should address export format, timing, assistance, deletion, and any copies the provider cannot feasibly remove.
Make the agreement operational
A useful BAA review connects contract language to the way your practice actually works: who manages security, how records are restored, how incidents are reported, and how data leaves the service. Compare the BAA with the service agreement and technical documentation, then resolve gaps before relying on the cloud service. Zevonix provides managed IT and cloud services for businesses in Volusia County. If your practice needs help reviewing its technology responsibilities and continuity planning, contact Zevonix to discuss your environment.