Business associate disclosure record

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

The covered entity owns the individual-right outcome

HHS explains that covered entities are responsible for access, amendment, and accounting rights. A business associate contract must require the associate to make information about relevant disclosures available. The parties may agree that the associate will provide an accounting directly, but that workflow should be explicit.

Translate the contract into an operating map. Identify which associate systems can make accountings-relevant disclosures, which party receives an individual's request, who searches events, who applies inclusion rules, who communicates with the person, and who retains delivery proof. Set a turnaround that leaves the covered entity enough time to validate and respond within its own deadline.

A direct-response arrangement needs the same clarity. The covered entity should know when the associate received the request, what was produced, how exceptions were handled, and when delivery occurred. Contract wording alone cannot show that an individual-right request was completed.

The event record needs accounting-ready fields

Because 45 CFR 164.528 includes certain disclosures to or by business associates, preserve date, recipient and known address, PHI description, purpose or qualifying request, source system, customer, correction history, and whether an exception applies. Contract language should also set delivery format and response time.

Specify time zone, file schema, required fields, identifiers, correction handling, and secure transfer. Require enough source detail to distinguish a completed disclosure from an attempt, retry, internal use, or excluded event. Use stable person and customer identifiers while limiting the exchanged data to what the accounting workflow needs.

Zero events is a result that still needs evidence. A signed or system-generated zero-event attestation for the requested period differs from a blank file, failed job, or unanswered ticket. Capture query parameters, run time, responsible party, and validation outcome.

Validate vendor evidence before a request arrives

Test the pathway during onboarding and periodically afterward. Send a fictional or approved test case, verify that the associate can search the required lookback, inspect field quality, and reconcile sample events to source records. Repeat testing after platform migrations, subcontractor changes, or contract amendments.

Maintain an associate inventory with product, PHI role, disclosure sources, response contact, backup, contract requirement, export method, and latest test date. Include subcontractor paths when they affect the associate's ability to return complete evidence. Escalate missing or incompatible logs through vendor risk and privacy governance.

Example across vendors

Three business associates are due to return quarterly event files. Two deliver validated files on time; one delivers no file and says it had no events without providing the agreed attestation. Vendor evidence completion is 2 of 3 associates. The unresolved vendor remains visible even if no individual request is pending.

If an individual later requests an accounting, the two validated vendors can supply period-specific events quickly. The third creates a deadline risk because its verbal assurance cannot be reproduced. The practice should keep that source in the accounting reconciliation, document escalation, and avoid treating silence as zero.

Business-associate record checklist

• Inventory associates and systems that may hold accountings-relevant events.
• Assign request receipt, search, classification, response, and retention roles.
• Contract for required fields, secure format, turnaround, and corrections.
• Distinguish completed events, attempts, retries, excluded events, and zero results.
• Test the search window and field mapping before a live request.
• Reconcile event counts and samples to associate source evidence.
• Track missing files, attestations, late returns, and corrected exports.
• Preserve the contract, request, transfer, validation, and final accounting linkage.

Owner controls

Inventory associates that create, receive, maintain, or transmit relevant PHI, map event ownership, test sample exports, reconcile totals, and define urgent request handling. A zero-event file, attestation, and missing file are different states. Retain the contract, transmissions, validations, and corrections.

Measure associates in scope, tested, timely, complete, and overdue. Review whether direct-response arrangements produce evidence visible to the covered entity. Vendor dashboards should show unresolved evidence even when no individual request is open, because remediation is far easier before a deadline starts.

Include this capability in vendor selection, renewal, and offboarding. Before termination, retrieve required historical logs, validate their readability, and assign future search ownership. Monitor subcontractor changes and product features that bypass the ordinary log. A vendor's security report can support general assurance, while only event-level accounting evidence can support a specific individual's request.

Require named escalation contacts and test them before the response pathway becomes urgent.