K
KROTKA
plHome

HIPAA BAA checklist: required provisions under 45 CFR 164.504(e)BETA

Any business that handles protected health information on behalf of a HIPAA covered entity needs a BAA with specific provisions. Health-tech vendors, hospitals and their compliance teams check it for every new arrangement.

Check your contract

Up to 20 pages a month free. Files are not stored.

Legal source

45 CFR § 164.504(e)(2)

Law as of

2013-01-25

Wording after the HIPAA Omnibus Rule (78 FR 5697, 25 January 2013), no later changes to this paragraph.

Our measurement

Precision 100%, recall 87% at first pass (2 BAAs incl. the HHS sample; small sample)

What we check (12 provisions)

  • Permitted and required uses and disclosures of PHI

    §164.504(e)(2)(i)

  • No use or disclosure other than permitted by the agreement or law

    §164.504(e)(2)(ii)(A)

  • Appropriate safeguards; Security Rule for ePHI

    §164.504(e)(2)(ii)(B)

  • Report improper uses/disclosures and breaches of unsecured PHI

    §164.504(e)(2)(ii)(C), §164.410

  • Subcontractors agree to the same restrictions

    §164.504(e)(2)(ii)(D)

  • Make PHI available for access (§164.524)

    §164.504(e)(2)(ii)(E)

  • Amendment of PHI (§164.526)

    §164.504(e)(2)(ii)(F)

  • Information for an accounting of disclosures (§164.528)

    §164.504(e)(2)(ii)(G)

  • When carrying out a covered entity obligation, comply with its requirements

    §164.504(e)(2)(ii)(H)

  • Books and records available to the Secretary (HHS)

    §164.504(e)(2)(ii)(I)

  • Return or destroy PHI at termination

    §164.504(e)(2)(ii)(J)

  • Termination if the business associate violates a material term

    §164.504(e)(2)(iii)

What the result looks like

For each provision you get "found" with a verbatim quote and the file name, or "not found in the documents". The quote is cut from the document character for character, so you can verify it in the original in seconds.

The engine is deterministic: no generative model, the same document always gives the same result. It does not judge whether a provision is adequate; that is the lawyer's call.

Frequently asked questions

What must a HIPAA business associate agreement contain?

Under 45 CFR § 164.504(e)(2): permitted and required uses and disclosures of PHI; no use or disclosure other than permitted by the agreement or law; appropriate safeguards; Security Rule for ePHI; report improper uses/disclosures and breaches of unsecured PHI; subcontractors agree to the same restrictions; make PHI available for access (§164.524); amendment of PHI (§164.526); information for an accounting of disclosures (§164.528); when carrying out a covered entity obligation, comply with its requirements; books and records available to the Secretary (HHS); return or destroy PHI at termination; termination if the business associate violates a material term. KROTKA checks each of these provisions separately.

Does KROTKA use AI to check the contract?

Not generative AI. The list runs on deterministic rules: the same document always gives the same result, and every provision found is shown as a verbatim quote you can verify. The engine does not invent or paraphrase anything.

Which version of the law do you compare with?

The law as of 25 January 2013. Wording after the HIPAA Omnibus Rule (78 FR 5697, 25 January 2013), no later changes to this paragraph.

How accurate is the list?

Our measurement: Precision 100%, recall 87% at first pass (2 BAAs incl. the HHS sample; small sample). The list is in beta. We measure on agreements the engine has not seen before, against independently prepared annotations.

Does KROTKA judge whether a clause is adequate?

No. It shows whether and where the provision appears. Judging its content is the lawyer's job. "Not found" means the engine found no such provision in the uploaded documents. KROTKA does not provide legal advice.

Is the HHS sample BAA enough?

The HHS sample contains the required provisions, but organisations usually modify it. The list shows whether anything was lost in negotiation.

Are my documents stored?

No. Files are analysed in memory and not stored on our servers. They are never used to train models.

How much does a check cost?

Up to 20 pages a month free. A single matter up to 150 pages is €24, the Professional plan €59 a month for 2,000 pages. Every list runs on every analysis.

Other checklists

Check your contract

Up to 20 pages a month free. Files are not stored.