A BAA for AI vendors must contain every element HIPAA lists in 45 CFR 164.504(e)(2): permitted uses, safeguards, breach reporting, subcontractor flow-down and return or destruction of PHI at termination. Then add what the rule never anticipated: limits on model training, retention of prompts and embeddings, named model providers, and the exact products and plans covered.
The easy mistake is to stop once a BAA exists. Legal confirms it, procurement files it, and nobody checks whether it covers the product, plan and feature the clinical team opened that morning. This checklist is for privacy, procurement and legal teams with the vendor's paper in front of them.
Last verified: 8 November 2026, against the eCFR text of 45 CFR Parts 160 and 164 (current to 5 November 2026, read through the official eCFR API), the January 2025 Security Rule proposal on GovInfo, Anthropic's BAA article and OpenAI's API data controls page. HHS's sample BAA provisions page and OpenAI's ChatGPT BAA help article both refused our requests, so neither is cited.
Who needs a BAA when an AI tool handles PHI?
Under 45 CFR 160.103, a business associate is a person who, on behalf of a covered entity and outside its workforce, "creates, receives, maintains, or transmits protected health information" for a regulated function. The definition also includes "a subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate."
So a typical AI product sits in a chain at least two links long. Your hospital or health plan signs with the AI vendor, and the vendor signs with whoever runs the model or stores the data, if that party touches PHI. Section 164.502(e)(1)(ii) lets a business associate pass PHI to a subcontractor if it "obtains satisfactory assurances" of safeguarding, documented in a written contract that meets 164.504(e).
You sign one link. You need evidence for both.
What must every BAA contain under 45 CFR 164.504(e)(2)?
The list is fixed and short enough to check line by line. Under 164.504(e)(2), the contract must:
- Establish permitted and required uses and disclosures, (e)(2)(i). Nothing the Privacy Rule would bar the covered entity from doing, except use for the vendor's "proper management and administration" and data aggregation for the covered entity's health care operations.
- Bar any other use or disclosure unless the contract or the law requires it, (ii)(A).
- Require appropriate safeguards and, for electronic PHI, Security Rule compliance where applicable, (ii)(B).
- Require reporting of uses or disclosures the contract does not allow, "including breaches of unsecured protected health information as required by § 164.410," (ii)(C).
- Flow down to subcontractors, who must agree "to the same restrictions and conditions," (ii)(D).
- Support individual access, amendment and accounting of disclosures under 164.524, 164.526 and 164.528, (ii)(E) to (G).
- Follow the Privacy Rule when carrying out a covered entity's obligation under it, (ii)(H).
- Open books and records on PHI to the HHS Secretary, (ii)(I).
- Return or destroy PHI at termination, if feasible, including PHI the vendor "still maintains in any form," or else extend the protections and limit further use, (ii)(J).
- Authorize termination by the covered entity for violation of a material term, (iii).
The Security Rule adds parallel terms in 164.314(a)(2)(i): comply with the applicable requirements, flow them down to subcontractors handling electronic PHI, and "report to the covered entity any security incident of which it becomes aware." Section 164.504(e)(5) applies the same contract rules between a business associate and its subcontractor.
Two more provisions matter. Under 164.502(a)(3), a business associate "may use or disclose protected health information only as permitted or required by its business associate contract" or by law, so a use the contract never mentions is not one the vendor can point to. Under 164.504(e)(1)(ii), a covered entity that knew of a pattern of material breach and took no reasonable steps to cure it, or end the contract where feasible, is itself out of compliance.
A proposal, not yet a rule. HHS's January 2025 Security Rule proposal (90 FR 898) would add a BAA term requiring notice of contingency plan activation "without unreasonable delay, but no later than 24 hours after activation." It would also have covered entities obtain written verification of a business associate's technical safeguards at least once every 12 months. The Federal Register lists no final rule affecting Part 164 as of 8 November 2026. Nothing stops you from asking for both terms now.
Which AI-specific clauses should you add on top?
Section 164.504 dates from 2000 and was last amended in 2013. It says nothing about models, embeddings or agents, so none of the clauses below is required by the text. Each is a term you negotiate.
- No training or fine-tuning on PHI without your written consent, including data derived from it. Silence gives the vendor no contractual basis for training, but invites argument when master terms mention "service improvement."
- De-identification rights and method. Section 164.502(d)(1) lets a covered entity disclose PHI to a business associate to create de-identified information, which then falls outside the Privacy Rule. For an AI vendor that is raw material for model work. If you allow it, require Safe Harbor or Expert Determination under 164.514(b), the documentation, and a ban on re-identification.
- The model provider and other subcontractors, named, with flow-down BAAs under 164.504(e)(2)(ii)(D) and notice before any new one is added.
- Retention and deletion of prompts, outputs, files, embeddings and logs, with a period per data type and a deletion certificate at exit. Whether a model fine-tuned on your data holds PHI "in any form" is a question for counsel to settle in the contract.
- Data location for the vendor and its model provider. None of the provisions we read sets one; state law or payer contracts may.
- Notification measured in days. The 60-day limit in 164.410 is a ceiling, and your own notice to individuals under 164.404(b) has the same 60-day ceiling.
- Human review and log access. Paragraph (ii)(I) helps the Secretary, not you. Ask for audit rights, logs of who sent what and when, and whether vendor staff can read prompts.
- Agent and connector actions named in the permitted uses, plus a list of connectors that send PHI to third parties.
- A coverage exhibit listing every product, plan, feature and endpoint covered, and a duty to tell you when it changes.
Two of these deserve a closer look. On breach timing, 164.410(b) requires notice "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach," and a breach counts as discovered when anyone at the business associate, other than the person who caused it, knew or with reasonable diligence would have known.
On retention, the form PHI takes inside an AI product varies by endpoint. OpenAI's API data controls page marks /v1/files, /v1/vector_stores, /v1/fine_tuning/jobs and /v1/batches, among others, as not eligible for zero data retention.
| Clause | What the regulation requires | What to add for AI | Red flags |
|---|---|---|---|
| Permitted uses | Set uses; no others, 164.504(e)(2)(i), (ii)(A); 164.502(a)(3) | Name chat, retrieval and agent actions; no training unless agreed | Open-ended "service improvement" uses |
| Safeguards | Appropriate safeguards, Security Rule, (ii)(B); 164.314(a)(2)(i)(A) | Controls covering prompts, outputs, files and embeddings | Security terms the vendor can change at will |
| Reporting | Breaches, (ii)(C); security incidents, 164.314(a)(2)(i)(C); 60-day limit, 164.410(b) | A window in days | No deadline, or 60 days as the target |
| Subcontractors | Same restrictions and conditions, (ii)(D); 164.502(e)(1)(ii) | Model provider and hosts named | "Our providers," unnamed |
| Books and records | Open to the Secretary, (ii)(I) | Your own audit and log access | Audit limited to a summary letter |
| Termination and return | Return or destroy PHI in any form, (ii)(J); termination, (iii) | Embeddings and logs included; deletion certificate | Backups and logs carved out indefinitely |
| De-identification | Not a required element; 164.502(d), 164.514(b) | Method, documentation, no re-identification | Unlimited rights to "anonymized" data |
| Coverage scope | Not a required element | Exhibit of products, plans, features, endpoints | "The Services," undefined |
