BAAs
When a vendor contract ends, what happens to the PHI?
A BAA must require the vendor, at termination, to return or destroy protected health information if feasible. If that's not feasible, its protections must continue and further use must be limited.
That only helps if someone follows up. The contract ends, the invoices stop, and the data can sit on a vendor's servers long after anyone remembers.
An exit checklist
Two or three months before the end date, confirm the end date and read the BAA's termination section. Ask the vendor how you'll get your records back, and in what format.
Before access ends, export what you need and make sure it opens. Then turn off vendor accounts, remote access and any data feeds.
If the vendor charges for an export, find out early. Some contracts set the format and the fee. If yours says nothing, the vendor gets to decide.
At the end, ask in writing for return or destruction of the PHI, including copies held by subcontractors, and for written confirmation. File that confirmation with the contract.
A worked example
Say you're replacing an answering service on June 30, 2027. The old vendor holds call logs and messages with patient names and symptoms. In April, you ask for an export of the messages you need to keep and for their destruction process for the rest.
On July 1 the new service is live and the old vendor's access to your scheduling system is shut off. By the end of July you have a letter confirming destruction, filed with the ended contract and its BAA. Put each of those steps on a date, or they slide.
When return or destruction isn't feasible
Sometimes a vendor can't destroy everything, for example data in backups it can't yet purge. The BAA must then extend its protections to that information and limit further use and disclosure to the purposes that make return or destruction infeasible (45 CFR 164.504(e)(2)(ii)(J)).
Ask the vendor to say in writing what it's keeping and why. That letter is worth more than a general promise.
What to watch
Have you asked for return or destruction?
Put the request in writing as part of your exit, and keep the response.
Do you have your own copy first?
Check you can get your records out, and in what format, before access ends.
Have accounts been shut off?
Vendor logins and connections should end with the contract.
Does it reach subcontractors?
Their copies need dealing with too.
Can you end it early for a violation?
The BAA must let you terminate if the vendor violates a material term. Check how that fits with the service agreement's own termination terms.
Is the outcome on file?
You may be asked to show this was done years later.
How Sapphires helps
- Mark the contract Expired or Terminated, and its BAA stays with it on the vendor's record.
- Expiration reminders at 60, 30 and 7 days give you time to plan the exit steps.
- Notes on the contract record what was done, and the change history shows when the status changed.
- Every contract and its PDF is copied to your own OneDrive, so your record outlasts the vendor relationship.
45 CFR 164.504(e)(2)(ii)(J): return or destruction at termination
45 CFR 164.504(e)(2)(iii): termination for a material violation