Your Business Associate Agreement Is Probably Too Thin. Here Is What to Add

Treat the HIPAA-required terms as the floor and negotiate shorter notification windows, specific security controls, audit rights, and subcontractor visibility. HIPAA lets a business associate take up to 60 calendar days after discovering a breach to notify you (HHS OCR), and the sample contract language HHS publishes explicitly allows parties to set a stricter timeframe (HHS). For vendors that run your IT or security, you should.

Most healthcare organizations sign whatever business associate agreement (BAA) the vendor sends. That is understandable, because the vendor's template usually includes the required terms. But "required" and "sufficient" are different standards, and 2026 enforcement shows why the difference matters.

What HIPAA requires in a BAA

Under 45 CFR 164.504(e), a BAA must establish permitted uses and disclosures of PHI, require appropriate safeguards including the Security Rule for ePHI, require reporting of unauthorized uses or disclosures and breaches, extend the same restrictions to subcontractors, support individual rights, make records available to HHS, require return or destruction of PHI at termination, and allow termination for material breach (45 CFR 164.504; HHS). Business associates are also directly liable for Security Rule failures.

What 2026 enforcement shows

In March, OCR settled with MMG Fusion, a software business associate, over a December 2020 intrusion that affected approximately 15 million individuals. OCR's investigation began after a complaint about an unreported incident and PHI posted on the dark web, and its findings included a failure to notify affected covered entities (HHS OCR). In other words, the covered entities did not hear about it from their vendor.

In April, OCR announced four ransomware settlements totaling $1,165,000 involving more than 427,000 individuals. Every one included a finding that the entity failed to conduct an accurate and thorough risk analysis (HHS OCR). One of the four, Consociate Health, is itself a benefits administrator, the kind of organization that sits on the business associate side of many relationships.

Clauses worth adding

• Short incident notification. Require notice of a suspected security incident within 24 to 72 hours, with a breach determination to follow. Sixty days is the legal maximum, not a reasonable expectation. We cover this in depth for security providers in MSSP contract breach notification deadlines.
• Named security controls. MFA for all access to PHI systems, encryption at rest and in transit, EDR, and log retention for a defined period.
• Risk analysis evidence. A right to see a summary of the vendor's most recent risk analysis, since that is the failure OCR cites most.
• Audit and assessment rights, or a commitment to share SOC 2 Type II or equivalent reports annually.
• Subcontractor disclosure. A list of subcontractors that touch your PHI, and notice before adding new ones.
• Cooperation in investigations, including log preservation and access for your incident response team.
• Data location and return. Where PHI is stored, and a defined format and timeline for return at termination.
• Cyber insurance with limits proportionate to the PHI the vendor handles.

Prioritize by access, not by spend

You likely have dozens of business associates. Start with those with the broadest access: EHR hosting, managed IT, managed security, billing, and cloud backup. A small IT provider with domain admin rights is a bigger risk than a large vendor with read-only access to one dataset. Ask each of them the questions in our MSSP shortlist guide, and compare answers against your contract.

Prepare for the Security Rule update

The proposed HIPAA Security Rule update would add explicit obligations around business associate verification. Its timeline has slipped, as we covered in the HIPAA Security Rule delay to 2027, but strengthening BAAs now is useful regardless of the final text. Our HIPAA Security Rule readiness checklist includes a vendor section.

Cyberuptive signs BAAs with healthcare clients and is comfortable with short notification terms. If you want a second opinion on your vendor contracts' security language, see our healthcare practice or contact us.

Frequently asked questions

How long does a HIPAA business associate have to report a breach?

Under the Breach Notification Rule, a business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured PHI. A BAA can require a shorter timeframe.

What must a business associate agreement include?

Under 45 CFR 164.504(e), a BAA must define permitted PHI uses and disclosures, require safeguards including Security Rule compliance, require reporting of breaches and unauthorized disclosures, bind subcontractors, support individual rights, give HHS access to records, require PHI return or destruction at termination, and allow termination for material breach.

Can a covered entity require stricter terms than HIPAA in a BAA?

Yes. HHS's sample BAA provisions note that parties may specify a stricter reporting timeframe, and covered entities can add security controls, audit rights, and other terms by contract.

What did OCR find in the MMG Fusion settlement?

OCR found potential impermissible disclosure of PHI of about 15 million individuals, failure to conduct an accurate risk analysis, and failure to notify affected covered entities of a breach. MMG Fusion paid $10,000 and agreed to a three-year corrective action plan.

Which business associates should be reviewed first?

Those with the broadest access to PHI systems, such as EHR hosting, managed IT and security providers, billing companies, and cloud backup vendors.