---
title: "Business associate subcontractor assurance checklist"
url: "https://ailawframework.com/precedents/health-and-medical-law/us-subcontractor-assurance"
type: "precedent"
site: "AI Law Framework"
id: "a32-us-subcontractor-assurance"
area_id: "A32"
kind: "checklist"
ai_level: "yellow"
version: 1
task_ids: ["A32-B7-2", "A32-T1-R9"]
law_stated_as_at: "2026-10-22"
---

# Business associate subcontractor assurance checklist

> Checklist for satisfactory assurances when a business associate uses a subcontractor, and for the other arrangements in 45 CFR 164.504(e)(3). It is not the subcontract.

Canonical page: https://ailawframework.com/precedents/health-and-medical-law/us-subcontractor-assurance  
Law stated as at: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

- Kind: Checklist. Steps or checks to work through and tick off.
- Practice area: [Health & Medical Law](https://ailawframework.com/precedents/health-and-medical-law.md)
- Jurisdictions: United States
- AI level: Yellow. You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at: 2026-10-22
- Status: Maintained. Checked on 2026-10-22 against the 2 authorities it cites, for United States.

## When to use it

Use when a business associate is about to let another person create, receive, maintain, or transmit protected health information on its behalf. Do not use it as the subcontract or as a data use agreement.

## Used for these tasks

- [Review an AI clinical-tool vendor contract for privacy and TGA issues](https://ailawframework.com/practice/health-and-medical-law/review-an-ai-clinical-tool-vendor-contract-for-privacy-and-tga-issues.md)
- [Review a hospital or health-services agreement](https://ailawframework.com/practice/health-and-medical-law/review-a-hospital-or-health-services-agreement.md)

## How AI may be used

Yellow: the lawyer decides whether the writing meets 45 CFR 164.504(e) before information is shared.

**AI may:**

- List the subcontractor assurance required by 45 CFR 164.502(e)(1)(ii) and 164.504(e)(5).
- List the other-arrangement paths in 164.504(e)(3) as questions, without completing them.
- Record a failed attempt to obtain assurances, if the lawyer supplies the facts.

**AI must not:**

- Do not sign a subcontract or a memorandum of understanding.
- Do not restate 45 CFR 164.314 or 164.514(e). Those sections were not opened.
- Do not decide that return or destruction of information is not feasible.
- Do not treat a limited data set as compliant without a data use agreement the lawyer has read.

**The lawyer checks:**

- Name the subcontractor and the function from the engagement.
- Read 164.314 before using a security-rule arrangement.
- Read 164.514(e) before relying on a limited data set.
- Keep any omitted termination term inside the statutory-obligation path in 164.504(e)(3)(iii).

## Authorities

- [45 CFR § 164.502](https://www.law.cornell.edu/cfr/text/45/164.502)
- [45 CFR § 164.504](https://www.law.cornell.edu/cfr/text/45/164.504)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/health-and-medical-law/us-subcontractor-assurance and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*