HIPAA business-associate readiness checklist
Identify whether a proposed independent business relationship needs HIPAA-related professional review and a qualified operating environment.
Done when: The data role, agreements, system ownership, safeguards and unresolved professional-review questions are explicit.
Enable JavaScript for on-page entry and smart printing, or print a blank copy from your browser and complete it offline.
Business role and data category
Describe the proposed role and whether it would create, receive, maintain or transmit health information. Record categories only, never examples of real information.
Qualified applicability review
Identify who determines the parties' legal roles and the agreements that apply. A label or a signed template alone does not establish compliance.
Approved systems and vendors
List the system/vendor names, accountable owners and the status of required reviews or agreements. Do not enter access credentials.
Access, retention and controls
Identify the planned minimum access, authentication, retention, backup and deletion responsibilities for the independent operator's secure environment.
Incident and subcontractor responsibilities
Identify who reviews incident-response, reporting and subcontractor obligations. Keep actual incident or health records out.
Go, hold or redesign
Record the professional-review outcome, remaining conditions and next owner. PublicProof offers business education and non-PHI services, not a HIPAA-compliance certification.
Reference links and review boundary
Use the current issuer, payer, regulator, platform or qualified professional for your exact activity and location. These links informed the planning questions; they do not make this an official form, full compliance review or permission to operate.
Healthcare businesses are welcome for business education. PublicProof does not receive, store or process patient information. A completed worksheet does not establish HIPAA compliance, transport qualification, professional authority, account approval, a credential, reimbursement or revenue.
Worksheet updated October 20, 2026. Verify changing requirements before relying on them.