The business associate agreement
If your product handles protected health information for a health system, expect a BAA under 45 CFR 164.504(e). Required terms include that the business associate will "(A) Not use or further disclose the information other than as permitted or required by the contract or as required by law; (B) Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information." Read the full section for the other required terms.
Source: 45 CFR 164.504(e). This page is a summary, not legal advice.
Frameworks and questionnaires you may be asked about
| Item | What it is | Source |
|---|---|---|
| HHS 405(d) HICP | Voluntary health-sector cybersecurity practices; the site links HPH Cybersecurity Performance Goals aligned with HICP and CISA | HHS 405(d) HICP; HHS HPH Cybersecurity Performance Goals |
| HSCC supply chain guide | Health Industry Cybersecurity Supply Chain Risk Management Guide (HIC-SCRiM-2023), health systems' own vendor-risk guidance | HSCC HIC-SCRiM-2023 |
| HITRUST | "The e1 provides foundational assurance with 43 core controls for low-risk entities. The i1 offers threat-adaptive protection with 182 controls"; the r2 is the highest tier. HITRUST also lists an AI security assessment. | HITRUST assessments |
| SOC reports | AICPA's System and Organization Controls (SOC) suite | AICPA SOC suite |
| Questionnaires | Shared Assessments SIG; Cloud Security Alliance CAIQ, alongside the Cloud Controls Matrix and AI Controls Matrix | Shared Assessments SIG; CSA Cloud Controls Matrix and CAIQ |
For how HIPAA, SOC 2 and HITRUST compare, see our HIPAA compliance page.
AI transparency asks
ONC's HTI-1 rule added decision support intervention criteria for certified health IT, 45 CFR 170.315(b)(11). For evidence-based and predictive decision support interventions, the Health IT Module must enable review of "source attributes" and "indicate when information is not available for review." This applies to certified health IT developers; a startup's model reaches it only if it is surfaced as a DSI through a certified EHR. Health systems may also reference the Coalition for Health AI, whose mission is "to advance the responsible development, deployment, and oversight of AI in healthcare" and which publishes an Applied Model Card.
Sources: 45 CFR 170.315(b)(11); ASTP/ONC HTI-1 Final Rule; Coalition for Health AI.
What it means for startups
Our reading (editorial, not from a source):
- Have a BAA position ready before the first security review.
- Keep a reusable answer set for SIG- or CAIQ-style questionnaires and update it with each review.
- Document your model in a form that maps to source-attribute and model-card requests if you sell AI.
Related resources
Frequently asked questions
What will a health system ask a digital health vendor for?
Commonly a business associate agreement if PHI is involved, plus security questionnaires and evidence such as SOC reports or HITRUST assessments.
What are the HITRUST e1 and i1?
HITRUST says the e1 provides foundational assurance with 43 core controls for low-risk entities and the i1 offers threat-adaptive protection with 182 controls; the r2 is its highest tier.
Does HTI-1 apply to AI startups?
Its decision support intervention criteria apply to certified health IT developers. A startup's model is affected if it is surfaced as a decision support intervention through a certified EHR.
Scope it in 30 minutes
Book a scoping call and we'll name the smallest engagement that moves you forward. Most teams start with the fixed-scope Initial Audit.
Book a 30-min scoping callPrefer to write? Send a short note.