What does a HIPAA business associate agreement cover for a US healthcare marketing agency?

What to take away

Who counts as a business associate under HHS rules

A marketing agency becomes a business associate when it handles protected health information to perform a service for your practice. That includes patient lists, call recordings, texting platforms, and analytics that touch identifiable data. The HHS Office for Civil Rights sets the standard in its Business Associates guidance.

The test is not the agency's label. A vendor that only receives de-identified data, or that works under a treatment, payment, or operations exception, may fall outside the definition. Most outreach vendors do not.

Your practice is a covered entity. The agency is a business associate. The BAA sets their contractual duties, while HITECH Act §§ 13401 and 13404 make business associates directly subject to specified HIPAA Security and Privacy Rule requirements and liability.

A single campaign can create the relationship. If the agency sends appointment reminders, runs recall texts, or manages review requests using patient names, it needs a BAA before the first message goes out.

State law can add layers. California's Confidentiality of Medical Information Act (Cal. Civ. Code §§ 56–56.37), Washington's My Health My Data Act (RCW 19.373), Texas's Medical Records Privacy Act (Tex. Health & Safety Code ch. 181), Florida Statutes § 456.057, New York Public Health Law § 18, and Illinois's Medical Patient Rights Act (410 ILCS 50) may apply, depending on the data and parties involved. A BAA does not override applicable state rules.

Clauses a BAA must carry for a marketing agency

The BAA contract requirements are in 45 CFR §§ 164.502(e) and 164.504(e), under the HIPAA Privacy Rule; the HITECH Act also imposes direct obligations on business associates. The contract must describe permitted uses, safeguards, required reporting, and what happens when something goes wrong.

The table below highlights a core permitted-use clause. The full BAA must also address the required terms listed here.

Under 45 CFR § 164.504(e), required BAA terms include:

Each clause should name a responsible role, not just a department. HHS's Office for Civil Rights (OCR) publishes sample business associate contract provisions, but there is no single required federal BAA form.

The linked CASL healthcare email marketing compliance guide concerns Canadian law and does not establish US HIPAA requirements. For this US review, collect the BAA, security questionnaire, and subcontractor list.

Permitted uses and disclosures and the prohibition on agency reuse

The BAA must state the exact purposes for which the agency may use PHI. For a marketing agency, that usually means patient outreach, appointment reminders, reputation management, and campaign measurement.

Anything outside that list is not permitted. The agency cannot use your patient list to build its own audience, enrich its database, or train a model. It cannot sell the data or share it with an ad platform without your written authorization.

OCR's HIPAA FAQs for Professionals explain that business associates may only use PHI as the contract allows. If the contract is silent, the use is not allowed.

Watch for broad language such as "and other business purposes." That phrase can swallow the prohibition on reuse. Ask for a closed list of purposes tied to your campaigns.

Patient communications need their own review. Texting and calling rules sit alongside HIPAA, and the consent and opt-out rules for patient texting are a common gap in vendor contracts.

If the agency wants to use aggregated or de-identified data for benchmarks, the BAA should say so and define the de-identification standard. Otherwise, assume the data stays identifiable and restricted.

Breach notification timelines practices should see in writing

The Breach Notification Rule is in 45 CFR Part 164, Subpart D; business associate notice requirements are at § 164.410. The Privacy Rule BAA requirements are at §§ 164.502(e) and 164.504(e). The eCFR text is the source to cite when a vendor disputes a deadline.

Under 45 CFR § 164.410, a business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovering a breach. That is the outer limit, not a target. Your BAA can and should require faster notice.

Practices should ask for notice within 24 to 72 hours for confirmed incidents. Early notice lets you start a risk assessment, involve counsel, and prepare patient communication before rumors spread.

The BAA should also say who calls whom. Name a security contact, a backup, and a method that works outside business hours. A breach discovered on a Friday night should not wait until Monday.

If the agency caused the breach, the contract should require the agency to help prepare required notifications to patients, OCR, and the media when thresholds are met. Your practice still carries the reporting duty, so the agency's work must be documented.

Include a duty to investigate and report root cause. A timeline without a cause analysis leaves you repeating the same incident with the same vendor.

Subcontractor and downstream vendor obligations

Marketing agencies rarely work alone. They use email platforms, texting gateways, call tracking tools, analytics providers, and freelance designers. Each one that touches PHI is a subcontractor.

The BAA must require the agency to sign a downstream agreement with every subcontractor that creates, receives, maintains, or transmits PHI on its behalf. The terms must be at least as strict as your BAA.

Ask for a current subcontractor list at signing and after any material change. If the agency adds a new texting vendor without telling you, your risk changes without your consent.

Call tracking is a frequent weak point. The call tracking comparison on this site shows what to verify when recordings and caller data are involved.

Flow-down clauses should cover breach notice, safeguards, and the prohibition on reuse. A subcontractor that can repurpose call recordings for its own product is a problem even if the main agency behaves well.

Your practice should have the right to object to a new subcontractor that cannot meet the terms. Without that right, the agency can expand its vendor stack at will.

What happens when an agency uses patient data for its own purposes

Using PHI for its own purposes is a breach of the BAA and, in many cases, a violation of HIPAA. The agency becomes directly liable to OCR for the unauthorized use.

Common examples include building a lookalike audience from your patient list, selling appointment data to a lead broker, or training a marketing model on patient messages. Each one exceeds the permitted uses in the contract.

When you discover the misuse, document it. Preserve logs, campaign exports, and written instructions. Then notify the agency in writing and demand an accounting of what was shared and with whom.

You may need to notify affected patients if the misuse creates a risk of harm. OCR evaluates the nature and extent of the data, who received it, and whether the risk was mitigated.

Remedies belong in the BAA. Ask for indemnification, audit rights, and the ability to terminate immediately for cause. Some practices add liquidated damages, though state law may limit those terms.

Report serious misuse to OCR. The agency's breach notice obligations do not replace your duty as a covered entity to report a breach that affects your patients. When OCR reporting is required, your practice can file through OCR's Breach Reporting Tool.

Termination, return, and destruction of PHI

The BAA must say what happens to PHI when the contract ends. The agency should return or destroy all PHI it holds, including backups, campaign exports, and derived files.

If return or destruction is not feasible, the BAA must extend the protections to the retained data and limit further use. That exception should be narrow and time bound.

Ask for a written certificate of destruction when records are shredded or wiped. For cloud systems, confirm that deletion covers replicas and disaster recovery copies.

Set a deadline, such as 30 days after termination, and withhold final payment until the certificate arrives. That gives the clause teeth.

Termination for cause should be available for a material breach that is not cured within a short window, often 10 to 30 days. Termination for convenience should also be defined so you are not locked in.

Keep a copy of the BAA and the destruction certificate for at least six years. OCR can ask for them during an investigation.

Security Rule safeguards that back the BAA

The BAA is only as strong as the safeguards behind it. The HIPAA Security Rule requires administrative, physical, and technical protections for electronic PHI. Its requirements include 45 CFR §§ 164.308, 164.312, and 164.314; the Security Rule Guidance Material explains what OCR expects.

Administrative safeguards include a risk analysis, a written security plan, workforce training, and incident response procedures. Ask for the agency's most recent risk analysis summary.

Physical safeguards cover offices, servers, and devices. If the agency is fully remote, ask how laptops and home networks are protected.

Technical safeguards include access controls, audit logs, encryption in transit and at rest, and automatic logoff. Encryption is not optional in practice; it is the main defense if a device is lost.

Outreach tools add their own risks. The ONC privacy and security guidance covers health IT privacy and security for tools that handle patient data.

Put the safeguards in the BAA as obligations, not marketing claims. A vague promise that the agency keeps data safe is not enforceable. Name the controls, the review cadence, and the evidence you will receive.

Build a routine for reviewing vendor security each year. Our guide to common healthcare marketing strategy questions covers contract renewals, training, and audit evidence in one cycle.

For a broader view of the rules that touch outreach, see the healthcare marketing compliance guide. It maps HIPAA, TCPA, FTC health products guidance, and state privacy laws to common campaigns.

Common questions