Does a Consultant Need a BAA? What HIPAA Says About Patient Data and Outside Help

What counts as patient information in a practice’s reports

Protected health information is individually identifiable health information, and 160.103 defines that as information that relates to a person’s health, to the care provided, or to “payment for the provision of health care to an individual,” and that identifies the individual or gives a reasonable basis to believe it can be used to identify them. Payment is in the definition, so a billing report is not exempt because it holds no diagnosis. A row with a patient name, an account number or a claim number tied to a date of service is protected health information.

Illustrative example: a report showing 140 claims denied last quarter for a missing authorization, 38 of them from one payer, counts claims and describes no individual. Whether a particular export clears that bar is for the practice’s privacy officer to judge, because small counts in a small practice can point back to a person.

Removing names is not the same as de-identifying. Under the Safe Harbor method in 164.514(b)(2), eighteen kinds of identifiers must be removed, including “all elements of dates (except year) for dates directly related to an individual,” medical record numbers, health plan beneficiary numbers and account numbers. A patient-level extract with no names but with dates of service is still protected health information. Between the two sits the limited data set in 164.514(e): direct identifiers removed, dates allowed, usable for research, public health or health care operations, and only under a data use agreement.

• Counts and totals with no patient rows: denials by reason code and payer by month, A/R aging buckets by payer, rejection counts by age, unsigned-note counts and dollars by provider, prior-authorization counts by payer and status.
• Patient information: any claim-level or visit-level row with a name, account or claim number, member ID or a date of service tied to a person, schedules, EHR screens, chart notes.
• Not de-identified even without names: patient-level rows that keep dates of service, admission dates or account numbers.

The minimum-necessary rule binds both sides

The minimum-necessary standard in 45 CFR 164.502(b) applies to the practice and to its business associates alike: each “must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.” It is not a courtesy. HHS lists the failure to make those efforts among the provisions for which a business associate is directly liable, alongside the Security Rule, impermissible uses and disclosures, and breach notification to the practice.

There is a detail in 164.514(d)(3)(iii)(C) that changes how a practice should read a consultant’s request. A covered entity may rely, where reasonable, on a business associate’s representation that the information it requests for professional services is the minimum necessary. In practice that makes the consultant’s written request list the document the practice relies on, so it should name each report and each field, say why each is needed, and say what is never requested.

The working pattern that follows from the rule is a sequence, not a single hand-over. First, reports that count and total, exported by the practice’s own staff. Then, only where a specific question cannot be answered from counts, a narrow patient-level extract under a signed agreement, with the fewest fields that answer it. Chart notes and clinical content stay out of an operations review entirely; nothing about where money stalls between the visit and the deposit needs them.

What a business associate agreement must say

Section 164.502(e) lets a practice disclose protected health information to a business associate only with “satisfactory assurance” that it will be safeguarded, documented in a written contract that meets 164.504(e). That section lists what the contract must do. A one-page letter that says “we respect your privacy” does not.

• Establish the permitted and required uses and disclosures — and not authorize anything the practice itself could not do, apart from the business associate’s own management and administration and data aggregation for the practice’s health care operations.
• Bind the business associate not to use or further disclose the information beyond the contract or as required by law.
• Require appropriate safeguards, and compliance with the Security Rule for electronic protected health information.
• Require reports to the practice of any use or disclosure the contract does not allow, including breaches of unsecured protected health information.
• Require every subcontractor that handles the information to agree to the same restrictions and conditions.
• Make information available for patients’ access, amendment and accounting of disclosures where the business associate holds it, and make the business associate’s relevant books and records available to the Secretary of HHS.
• At termination, return or destroy the information and keep no copies — or, where that is not feasible, extend the protections and limit further use.
• Authorize the practice to terminate the contract if the business associate violates a material term.

HHS publishes sample business associate agreement provisions as a starting point, and says plainly that it is only sample language, that using it is not required for compliance, and that it does not replace consultation with a lawyer. The practice’s attorney adapts it to the engagement.

The agreement does not end at the consultant’s door

Patient information sent to a consultant can pass through several places. Files arrive by email, sit in cloud storage, open in a spreadsheet and may pass through an analysis tool. Under 160.103 each subcontractor that creates, receives, maintains or transmits the information on the business associate’s behalf is itself a business associate, and HHS says a business associate must have a BAA with its subcontractor before disclosing protected health information to it. HHS names a cloud service provider that stores or processes electronic protected health information as a business associate in its own right.

That turns one question into several. Where will the files live? Which email system carries them? Is any AI or analysis tool going to read them, and if so, under what agreement? Who at the firm can open them, and on what devices? When the engagement ends, who deletes what, and how is that confirmed? A consultant who can answer these in writing has thought about it. One who answers “we’re HIPAA compliant” has answered a different question. HHS says it does not certify any persons or products as “HIPAA compliant,” and a business associate agreement is a contract, not a credential.

Questions to ask before any file leaves the practice

These belong in the first conversation, before a contract and well before an export. None of them requires a lawyer to ask; the practice’s compliance officer or attorney decides what to do with the answers.

• Which reports do you need first, field by field, and can every one of them be a count or total with no patient-level rows?
• Which question, if any, needs patient-level data, and what is the smallest set of fields that answers it?
• Who exports the reports — our staff, or you with a login? If a login, is it read-only, limited to the reports named, and ended on a date?
• Will you sign our business associate agreement before anything identifiable moves, and which subcontractors will touch the data?
• Where will the files be stored, who can open them, and how will you confirm deletion at the end?
• What will you never request? For an operations review, chart notes, clinical content and full patient lists belong on that list.

When the answer is to share nothing — and how our Review works

If the question can be answered from counts, nothing identifiable needs to leave the practice, whoever is asking. If a firm needs full EHR access on day one, cannot name its subcontractors, or treats the agreement as paperwork to sign later, the honest move is to decline that engagement, whatever it promises to find. And if the issue is a HIPAA risk analysis, a breach or a complaint, that is work for a privacy professional and counsel, not for an operations consultant.

Our Revenue Review is built to sit on the safe side of the line by default. The first pass runs on aggregate reports the practice exports itself: counts, dollar totals, aging buckets and denial reason codes, with no patient names, phone numbers or other identifiers. Patient-level records are requested only under a signed BAA; otherwise the Review works from aggregate reports only. Chart notes and clinical content are never part of it. It takes two weeks and ends in a written report the practice keeps. It certifies no HIPAA compliance and gives no legal advice.

The next step is a free 20-minute call. Bring the list of reports the practice can export; the call is where a request list gets written before anything moves.