A HIPAA subcontractor agreement is a written contract between a business associate and a subcontractor that ensures the subcontractor will protect protected health information (PHI) in the same way the business associate is required to. Under the HIPAA Omnibus Rule, business associates are directly liable for the actions of their subcontractors, so a compliant agreement is not optional—it is a legal requirement.
Background: Why Subcontractor Agreements Exist
HIPAA’s Privacy and Security Rules were originally written to cover covered entities (health plans, health care clearinghouses, and most health care providers). The HITECH Act of 2009 extended many of those obligations to business associates—companies that create, receive, maintain, or transmit PHI on behalf of a covered entity. The 2013 Omnibus Rule went one step further: it made business associates directly liable for HIPAA violations, and it explicitly required business associates to obtain “satisfactory assurances” from subcontractors that they will safeguard PHI. That requirement is met through a written subcontractor agreement.
A subcontractor is any person or entity that creates, receives, maintains, or transmits PHI on behalf of a business associate. This includes cloud storage providers, data analytics firms, transcription services, IT support vendors, and even a freelance consultant who accesses PHI. If the business associate gives the subcontractor access to PHI, a HIPAA subcontractor agreement is required—regardless of how small the task is.
What the Agreement Must Contain
HIPAA does not provide a single official template, but the regulation (45 CFR 164.308(b)(4) and 45 CFR 164.314(a)) lists specific elements that must appear in any business associate agreement. A subcontractor agreement must include those same elements, adapted for the subcontractor’s role. At a minimum, it must:
- Describe the permitted and required uses of PHI by the subcontractor—usually limited to what is necessary to perform the contracted services.
- Prohibit the subcontractor from using or disclosing PHI beyond what is permitted or required by the agreement.
- Require the subcontractor to implement appropriate safeguards to prevent unauthorized use or disclosure, including administrative, physical, and technical safeguards.
- Require the subcontractor to report any use or disclosure not permitted by the agreement, including breaches of unsecured PHI, to the business associate.
- Require the subcontractor to ensure that any of its own agents or subcontractors agree to the same restrictions and conditions.
- Require the subcontractor to make PHI available to the business associate as needed for the business associate to comply with a patient’s request for access or amendment.
- Require the subcontractor to provide an accounting of disclosures as required by the Privacy Rule.
- Require the subcontractor to make its internal practices, books, and records available to the Secretary of Health and Human Services (HHS) for purposes of determining compliance.
- Require the subcontractor to return or destroy PHI when the contract ends, if feasible, and if not feasible, to extend the protections indefinitely.
- Give the business associate the right to terminate the agreement if the subcontractor violates a material term.
In practice, many business associates use the same agreement they signed with the covered entity, with the names and roles changed. That is acceptable as long as every required element is present.
How It Works in Practice
When a business associate hires a subcontractor, the flow of obligations looks like this: the covered entity has an agreement with the business associate; the business associate has an agreement with the subcontractor. The subcontractor, in turn, must have agreements with any of its own subcontractors. This chain of agreements ensures that PHI is protected no matter how many layers deep the work goes.
For example, a medical billing company (business associate) hires a software developer to fix a patient portal. The developer will have access to PHI, so the billing company must sign a subcontractor agreement with the developer. If the developer then outsources testing to a third party that will also see PHI, the developer must sign a similar agreement with that tester. Each link in the chain must be documented.
The agreement should also specify the subcontractor’s obligations regarding breach notification. The subcontractor must notify the business associate of any breach without unreasonable delay, and the business associate is then responsible for notifying the covered entity. The subcontractor does not report directly to HHS unless the business associate fails to act.
How to Choose the Right Agreement
Selecting or drafting a subcontractor agreement is not a one-size-fits-all task. The key is to match the agreement to the actual services and data access. Consider the following:
- Scope of data: Does the subcontractor need access to all PHI or just a limited data set? The agreement should reflect the minimum necessary.
- Type of PHI: If the data includes mental health records, HIV status, or substance abuse treatment records, additional state and federal protections may apply. The agreement should reference those.
- Duration: How long will the subcontractor have access? The agreement should state the term and the conditions for termination.
- Subcontracting: Will the subcontractor hire its own subcontractors? If so, the agreement must require the subcontractor to obtain written authorization and to ensure those downstream entities comply.
- State laws: Some states have stricter privacy laws. The agreement should specify which state’s law governs, but it must still meet the federal minimum.
Do not simply copy a template from the internet without reviewing it. A generic template may not cover state-specific requirements or the particular services your subcontractor provides. If you are unsure, consult a health care attorney.
Common Problems and Misconceptions
One common misconception is that a subcontractor agreement is only needed if the subcontractor will “touch” PHI directly. In reality, the rule applies to any subcontractor that creates, receives, maintains, or transmits PHI on behalf of a business associate. Even a company that only provides encrypted data storage is a subcontractor if it maintains PHI.
Another frequent problem is failing to update agreements when the business relationship changes. If a subcontractor’s role expands to include new types of PHI or new services, the agreement must be revised. Similarly, if a subcontractor is acquired by another company, the new entity must sign a new agreement.
A third issue is the “pass-through” problem. Some business associates believe that if their agreement with the covered entity already includes downstream liability, they do not need separate subcontractor agreements. That is incorrect. The business associate is still required to obtain satisfactory assurances from each subcontractor, and those assurances must be documented in writing.
Finally, many organizations forget to include the requirement that the subcontractor provide an accounting of disclosures. This is a required element, even though it is rarely used in practice.
Costs and Consequences of Noncompliance
There is no direct cost to sign a subcontractor agreement—it is just a contract. The real cost comes from noncompliance. HHS can impose civil monetary penalties on business associates and subcontractors for HIPAA violations. Penalties range from $100 to $50,000 per violation, with a maximum of $1.5 million per calendar year for identical violations. In addition, state attorneys general can bring actions for damages, and a breach can lead to reputational harm and loss of clients.
Beyond fines, a business associate can be held liable for a subcontractor’s violation if the subcontractor did not have a compliant agreement in place. That means the business associate could face penalties for actions it did not directly commit. This is why the agreement is not just a formality—it is a risk management tool.
Template for a HIPAA Subcontractor Agreement
Below is a generic template you can adapt. It is not legal advice; have it reviewed by a qualified professional for your specific situation.
| Section | Description |
|---|---|
| Parties | This Subcontractor Agreement is between [Business Associate] and [Subcontractor] (“Subcontractor”). |
| Definitions | All terms used in this Agreement have the meanings set forth in HIPAA, including “Protected Health Information” (PHI) and “Business Associate.” |
| Permitted Uses | Subcontractor may use PHI only to perform [describe services] for Business Associate. |
| Prohibited Uses | Subcontractor shall not use or disclose PHI other than as permitted by this Agreement or as required by law. |
| Safeguards | Subcontractor shall implement administrative, physical, and technical safeguards to protect PHI. |
| Breach Notification | Subcontractor shall notify Business Associate of any breach of unsecured PHI without unreasonable delay. |
| Downstream Subcontractors | Subcontractor shall ensure that any agents or subcontractors that receive PHI agree to the same restrictions. |
| Access and Amendment | Subcontractor shall make PHI available to Business Associate for access and amendment requests. |
| Accounting of Disclosures | Subcontractor shall provide an accounting of disclosures as required by the Privacy Rule. |
| HHS Access | Subcontractor shall make its internal practices and records available to HHS for compliance purposes. |
| Return or Destruction | Upon termination, Subcontractor shall return or destroy all PHI, or extend protections if return/destruction is not feasible. |
| Termination | Business Associate may terminate this Agreement if Subcontractor violates a material term. |
Sample (fictional): This Subcontractor Agreement is between ABC Billing Services (Business Associate) and XYZ Data Solutions (Subcontractor). Subcontractor may use PHI only to provide data backup services for ABC Billing Services. Subcontractor shall not use or disclose PHI other than as permitted. Subcontractor shall implement safeguards. Subcontractor shall notify ABC Billing Services of any breach without unreasonable delay. Subcontractor shall ensure any downstream agents agree to the same restrictions. Subcontractor shall make PHI available for access and amendment. Subcontractor shall provide an accounting of disclosures. Subcontractor shall make records available to HHS. Upon termination, Subcontractor shall return or destroy all PHI. ABC Billing Services may terminate if Subcontractor violates a material term.
Frequently Asked Questions
Do I need a separate agreement for each subcontractor?
Yes. Each subcontractor that will have access to PHI must have its own written agreement with the business associate. You cannot rely on a single agreement to cover multiple subcontractors, because each has different roles and data access.
Can I use the same agreement I signed with the covered entity?
You can use the same structure, but you must change the parties and adjust the permitted uses to match the subcontractor’s specific services. Simply changing the names is not enough if the services differ.
What happens if I don’t have a subcontractor agreement?
You are in violation of HIPAA, and you could be subject to civil penalties. More importantly, if the subcontractor has a breach, you may be held liable for their failure to protect PHI.
Does a subcontractor have to report breaches directly to HHS?
No. The subcontractor reports to the business associate, who then reports to the covered entity, who then reports to HHS if required. The subcontractor does not have a direct reporting obligation to HHS.
Can a subcontractor be a covered entity itself?
Yes, but the agreement still applies. If a subcontractor is also a covered entity (e.g., a hospital that provides consulting services), it must still sign a subcontractor agreement for the specific PHI it handles for the business associate.
What if the subcontractor is located outside the U.S.?
HIPAA does not prohibit using foreign subcontractors, but the agreement must still require compliance with HIPAA. The subcontractor must implement safeguards and report breaches, regardless of location. You should also consider data residency requirements under state law.