Is your MSP a HIPAA business associate? What the BAA should say

Is your MSP a HIPAA business associate?

In most cases, yes, which means you need a business associate agreement (BAA) with your MSP. If your managed IT provider can reach the systems where electronic protected health information (ePHI) lives, such as email, file shares, backups or line-of-business applications, it maintains or has access to that data on your behalf. The definition of business associate at 45 CFR 160.103 covers any person that creates, receives, maintains or transmits PHI for a covered entity, and it expressly includes subcontractors of business associates.

HHS has closed the usual escape routes. Its cloud computing guidance says a cloud provider that stores ePHI is a business associate even if it stores only encrypted data and has no decryption key. The same guidance limits the "conduit" exception to transmission-only services, like a courier or an internet service provider, whose access is transient. An MSP with administrator rights to your Microsoft 365 tenant, servers and backup console has persistent access, which puts it on the business associate side of that line.

This applies whether you are a covered entity (a clinic, a health plan) or a business associate yourself. Law firms, accounting firms and nonprofits that handle PHI for healthcare clients are business associates, and their MSP is a subcontractor. Under 45 CFR 164.502(e) and 164.504(e)(5), a business associate needs the same written assurances from its subcontractors that its client required of it. HHS also says that using a cloud vendor to maintain ePHI without a business associate agreement (BAA) is a violation of the HIPAA Rules, and its guidance points to an OCR resolution agreement with an organization that stored ePHI for more than 3,000 people on a cloud server with no BAA in place.

What should an MSP business associate agreement include?

Every BAA must contain the terms listed in 45 CFR 164.504(e)(2) and, for electronic PHI, 45 CFR 164.314(a)(2)(i). Together they require the agreement to:

• Establish the permitted and required uses and disclosures of PHI by the business associate.
• Bar any other use or disclosure, except as the contract permits or the law requires.
• Require appropriate safeguards and compliance with the Security Rule (Subpart C) for ePHI.
• Require the business associate to report uses or disclosures the contract does not allow, any security incident it becomes aware of, and breaches of unsecured PHI under 45 CFR 164.410.
• Require subcontractors that handle the PHI to agree to the same restrictions and conditions.
• Make PHI available for individual access, amendment and accounting of disclosures where the business associate holds it.
• Make internal practices, books and records available to HHS for compliance review.
• Return or destroy all PHI at termination if feasible, and extend the contract's protections to anything that cannot be returned or destroyed.
• Authorize the covered entity to terminate the agreement if the business associate violates a material term.

HHS publishes sample business associate provisions, and many MSPs use them as a starting point. HHS cautions that relying on the sample alone may not be sufficient for compliance with state law. Treat it as a floor for the conversation.

Where do standard BAAs leave gaps for an IT provider?

Standard BAAs leave the numbers open. The regulation tells a business associate to report a breach of unsecured PHI "without unreasonable delay and in no case later than 60 calendar days after discovery" under 45 CFR 164.410(b). HHS's cloud guidance says the Security Rule "does not prescribe the level of detail, frequency, or format" of security incident reports, so the parties are expected to set those terms in the agreement.

A BAA written on the vendor's paper often leaves every one of those choices at the most permissive setting. For an IT provider, the gaps that matter most are:

• The reporting clock. Sixty days is the outer limit. HHS's sample provisions note that the parties may add a stricter timeframe.
• Unsuccessful attempts. The Security Rule's definition of security incident at 45 CFR 164.304 includes attempted unauthorized access. HHS says the agreement can address whether reporting patterns of attempted incidents is reasonable and appropriate, and can set different levels of detail and frequency by severity, which avoids both silence and a flood of blocked-login notices.
• Subcontractors. Your MSP likely relies on remote management, backup, email security and hosting vendors. Each one that touches ePHI needs its own agreement with the MSP.
• Evidence. HHS notes that the HIPAA Rules do not expressly require a cloud provider to document its security practices for customers. Customers may still require documentation, audits or other assurances through the BAA or service agreement.
• Availability and exit. HHS says service level terms on availability, backup and data recovery should be consistent with the BAA. Return or destruction at termination should name backups and copies in the MSP's tools.

Which terms should you ask your MSP to add?

Ask for terms that turn the open-ended obligations into commitments you can check. None of the items below is spelled out in the regulation; each fills a blank the regulation leaves:

• A breach reporting deadline measured in hours or days, well inside 60 days, with a named contact on each side.
• Minimum content for an incident report: what happened, which systems and data were involved, what was contained, and what remains unknown.
• A commitment to supply the facts you need for your own breach risk assessment and notices. 45 CFR 164.410(c)(2) already requires the business associate to provide information the covered entity needs for notices to individuals.
• A current list of subcontractors with access to ePHI, advance notice before a new one is added, and confirmation that each has signed a BAA.
• A right to evidence on request within a set time, such as MFA coverage, patch status, backup test results, access logs and a summary of the MSP's own risk analysis.
• Backup and restore commitments that match the service agreement.
• An exit procedure: the format in which data comes back, removal of the MSP's tools and accounts, deletion from backups, and written confirmation.

Your MSP also has direct obligations of its own. HHS's business associate direct liability fact sheet lists the requirements HHS can enforce against a business associate, including Security Rule compliance and breach notice to the covered entity. A BAA does not replace the MSP's own risk analysis under 45 CFR 164.308(a)(1). OCR keeps enforcing that requirement, as our look at HIPAA risk analysis enforcement explains.

How would the proposed Security Rule change vendor oversight?

It would make oversight of business associates more formal, but it is still a proposal. HHS published the proposed HIPAA Security Rule update on January 6, 2025. According to the HHS fact sheet, business associates would have to verify "at least once every 12 months" that they have deployed required technical safeguards, through a written analysis by a subject matter expert and a written certification. Business associates would also have to notify covered entities of contingency plan activation "no later than 24 hours after activation."

HHS has not finalized the rule, and the current Security Rule remains in force. A BAA that already includes an evidence right and a short notice clock will need fewer changes if those provisions are adopted. For the latest on timing, see where the HIPAA Security Rule update stands.

What should you check in your MSP's BAA this quarter?

Start with the agreements you already have: confirm that every vendor able to reach ePHI has a signed BAA, then test whether its terms hold up in practice.

• List every IT, cloud, backup and email security vendor that can reach ePHI, and confirm a signed BAA exists for each.
• Compare the reporting deadline in your MSP's BAA with the deadline in your own client BAAs. If a healthcare client gives you 10 days, a vendor with 60 days leaves you exposed.
• Ask your MSP for its subcontractor list and confirmation that each subcontractor has a BAA.
• Request one item of evidence, such as last month's backup test result, and time how long it takes to arrive.
• Schedule a BAA review whenever you add a service or change providers, and have counsel review any changes to contract terms.

How does s90 approach business associate terms?

s90's client agreements include a 72-hour breach notification commitment and a 24-hour evidence production commitment, which gives a BAA specific numbers to point to instead of the regulatory maximum. If you would like a second look at how your current BAA handles reporting, subcontractors and exit, we are glad to walk through it with you and your counsel.