Six Business Associate Agreement Mistakes That Survive Until an Audit
Business Associate Agreements are administratively dull, which is exactly why they drift. An afternoon of reconciliation each year prevents a finding that has cost practices six figures.
Mistake 1: The vendor nobody thought of
The obvious vendors have agreements. The ones that go missing are the quiet ones — the answering service, the shredding company, the IT contractor with remote access, the cloud backup added by whoever set up the server, the transcription service one provider uses. Reconcile your vendor list against accounts payable annually and ask of each line: could they see ePHI? If the honest answer is yes or maybe, you need an agreement.
Mistake 2: The template that was never signed
A surprising number of practices hold an unsigned BAA template in a folder labelled as though the matter were closed. An unsigned agreement is not an agreement. Check every one for both signatures and a date, and keep the executed copy rather than the draft.
Mistake 3: No subcontractor flow-down
Your billing company uses a clearing house. Your EHR vendor uses a hosting provider. The agreement must require your business associate to bind its own subcontractors to equivalent terms. Without that clause the chain breaks one link down, which is precisely where breaches tend to originate.
Mistake 4: Breach notification terms that are useless in practice
Your notification obligation runs from discovery, and a business associate's discovery can start your clock. An agreement that says the associate will notify you 'promptly' or 'without unreasonable delay' gives you nothing to enforce. Specify a number of days, require an initial report even when the facts are incomplete, and require ongoing updates.
Mistake 5: Nothing happens at termination
When the relationship ends, the agreement should require return or destruction of all ePHI, with certification. Practices routinely part ways with a vendor and leave years of records sitting in a system nobody monitors. Ask for the certificate of destruction, and file it.
Mistake 6: Signing the agreement and stopping there
A BAA is a contract, not a control. It allocates liability; it does not make the vendor secure. For any vendor with meaningful ePHI access, assess their security posture before onboarding and periodically after — at minimum ask for their most recent independent assessment and read it. The agreement is what you rely on after something goes wrong; the assessment is what stops it going wrong.
The annual reconciliation, concretely
Export the last twelve months of accounts payable. Mark every vendor that could plausibly touch ePHI. Match each against your executed agreements. Chase the gaps that week, because the exercise loses its value if the list sits. Keep the reconciliation itself — dated and signed — because it is the evidence that your vendor management process operates.
Key takeaways
- 1.Reconcile vendors against accounts payable annually; the quiet vendors are the gaps
- 2.An unsigned template is not an agreement — check for signatures and dates
- 3.Require subcontractor flow-down and a specific breach notification deadline in days
- 4.A BAA allocates liability; only a security assessment reduces risk