SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-baa-return-destroy

When a business associate contract ends, what must happen to the PHI the business associate still holds, if feasible?

Return or destroy it, keeping no copies.

Start playing free

  1. Return or destroy it, keeping no copies ✔
  2. The business associate keeps it six years
  3. Send it to HHS for storage

Why: The contract must require the business associate to return or destroy all PHI it still has when the contract ends. If that isn't feasible, the contract's protections keep covering that PHI.

Huh, didn't know that: The contract must also let the covered entity end it if the business associate violates a material term.

The dad joke
Why did the man quit his job at the shoe recycling factory? It was sole destroying.
Like this card?
Play the game

References

Answer: Return or destroy it, keeping no copies. The contract must require the business associate to return or destroy all PHI it still has when the contract ends. If that isn't feasible, the contract's protections keep covering that PHI.

  1. 45 CFR 164.504 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504
    At termination of the contract, if feasible, return or destroy all protected health information
    Checked 2026-10-10.
  2. 45 CFR 164.504 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504
    Authorize termination of the contract by the covered entity, if the covered entity determines that the business associate has violated a material term
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsA clinic hires an outside company to handle its insurance billing using patient records. What is that company under HIPAA?Work SkillsA clinic sends records to a specialist who will treat the patient. Is the specialist the clinic's business associate?Work SkillsA business associate hires a subcontractor that will handle PHI. Who must get the subcontractor's written assurances?

That's stuff everyone should know.