PHI Translation Handling: HIPAA, BAAs, Controls and Breach Duties
In the United States, a translation vendor that creates, receives, maintains or transmits PHI for a covered entity acts as a business associate. HIPAA requires a written business associate agreement (BAA) before PHI moves. The vendor must apply Security Rule safeguards, limit access to assigned staff, control its subcontractors and report breaches to the covered entity within the agreed deadline, never later than 60 days from discovery.
Table of Contents
What counts as PHI in a translation workflow?
PHI is individually identifiable health information held or transmitted by a covered entity or its business associate. In translation, PHI is not limited to the document a client sends. It can sit in several places in the workflow.
Source files: clinical notes, discharge summaries, consent forms, claims, explanation of benefits letters, lab reports, insurance ID cards and patient correspondence.
Working files: bilingual exports, translation memory segments, term lists, query logs and reviewer comments that quote patient details.
Media: screenshots, scanned images, audio and video recordings of consultations, and voice-over scripts.
Reference material: prior translations or glossaries that were built from patient records.
One company guide on medical translation policies notes that PHI appears in source files, terminology lists, screenshots, audio and reference materials. A data inventory for each project should list every one of these locations.
A translation memory is a frequent blind spot. A segment copied from a patient letter stays in the memory after the project closes. Treat the memory as a PHI repository unless the content was de-identified before it was stored.
When is a translation provider a business associate?
A translation provider is a business associate when it performs a function for a covered entity that involves PHI. Hospitals, clinics, health plans and pharmacies are covered entities. A language vendor that translates their records, forms or recordings on their behalf falls into the business associate category.
HHS addresses a closely related case. HHS guidance on interpreters states that a covered entity does not need an individual’s authorization to disclose PHI to an interpreter who acts as a workforce member or a business associate, when the disclosure is for treatment, payment or health care operations. The disclosure is permitted. The permission does not remove the need for a BAA when the interpreter or translator is an outside party.
The chain continues downward. A vendor that hires freelance linguists or uses a hosting provider passes PHI to subcontractors. HHS cloud computing guidance states that a cloud service provider that handles ePHI for a business associate is itself a business associate, even when it stores only encrypted data and holds no key. The same logic applies to freelancers and any tool vendor that touches PHI.
What must a business associate agreement cover, and when must it be signed?
The BAA must be signed before any PHI is disclosed. HHS business associate guidance states that a covered entity may disclose PHI to a business associate only after obtaining satisfactory assurances, in a contract or other written arrangement, that the business associate will appropriately safeguard the information.
The same guidance states that the agreement must require the business associate and its subcontractors to comply with the applicable Security Rule requirements. A practical BAA for translation work addresses these items:
Permitted uses: translation, review, quality assurance and delivery only.
Safeguards: the administrative, physical and technical controls the vendor applies.
Subcontractors: written agreements with every linguist, reviewer and hosting provider that handles PHI.
Incident and breach reporting: the deadline, contact channel and content of the report.
Return or destruction: what happens to source files, drafts, memories and backups at project end.
Audit and records: what evidence the covered entity may request.
The covered entity should set a reporting deadline shorter than the legal maximum. Sixty days is a ceiling, not a target.
Can PHI be de-identified or redacted before translation?
Yes. Data that meets the HIPAA de-identification standard is no longer PHI. A 2016 testimony to the NCVHS Subcommittee describes the two HIPAA paths: the Safe Harbor method and expert determination. Safe Harbor removes a defined list of identifiers. Expert determination relies on a qualified statistician who documents that the risk of re-identification is very small.
Redaction for translation is harder than it looks.
Free text hides identifiers in narrative: a rare diagnosis, a job title, a small town or a date.
Scanned documents and images carry identifiers that text search does not find.
Translators need clinical context. Removing too much reduces accuracy.
Redacting, then restoring identifiers in the target file, creates a second PHI handling step.
Use de-identification when the purpose allows it, for example translating a training manual or a de-identified study report. Where the translation must stay attached to a patient, such as a discharge summary, keep the PHI and rely on the BAA and safeguards. The covered entity decides which path applies and records the decision.
How should PHI be protected from intake to deletion?
The HIPAA Security Rule requires administrative, physical and technical safeguards for ePHI. The HHS Security Rule summary also states that regulated entities must evaluate their safeguards periodically and adjust them for new technologies and newly recognized risks, and that device and media controls must govern the receipt, removal and final disposition of hardware or media holding ePHI.
The table maps each stage to an owner and a control.
Stage | Owner | Control |
Intake | Covered entity project lead | BAA in place, data inventory, minimum necessary scope |
Transfer | Vendor security lead | Encrypted channel such as TLS 1.2 or higher, no email attachments |
Assignment | Vendor project manager | Role-based access control, named linguists only |
Translation and review | Linguists and reviewers | Access control, no local copies, no public tools |
Quality assurance | Vendor quality lead | QA on a controlled platform, comments scrubbed of PHI |
Delivery | Vendor project manager | Encrypted return, delivery confirmation |
Storage | Vendor security lead | Encryption at rest such as AES-256, audit trail of access |
Deletion | Vendor security lead | Documented disposal of files, memories and backups |
The company guide cited earlier lists encryption at rest and in transit, role-based access and multi-factor authentication as technical safeguards, and advises limiting PHI access to staff directly involved in the project. These are good practice examples, not a HIPAA-mandated list of products.
Two controls deserve specific attention.
Authentication. Require two-factor authentication for every account that opens PHI, including linguist portals and file-sharing tools. Hardware keys are one option.
Physical and media controls. Linguists working in an office or a vendor facility need physical access control for rooms, workstations and storage media. Remote linguists need managed devices, screen locks and a ban on local storage and removable media.
An audit trail should record who opened, edited, exported and deleted each file. Without it, the vendor cannot answer the covered entity’s questions after an incident.
How should an organization evaluate a translation provider’s PHI safeguards?
Ask for evidence, not assurances. A vendor’s statement that it is HIPAA compliant is a claim. The following criteria turn it into something checkable.
BAA. The vendor signs your BAA or a BAA you can review before any file moves.
Subcontractor chain. The vendor names every party that touches PHI and holds BAAs with them.
Risk analysis. The vendor has a current, documented security risk analysis. HHS investigation findings in the MedEvolve resolution agreement cited a missing BAA with a subcontractor and a risk assessment that was not sufficiently accurate or thorough.
Independent audits. Certifications such as ISO 27001 for information security, audited by an accredited third party, show a managed security system. They support but do not replace HIPAA obligations.
Data location and tooling. The vendor states where data is processed and whether any public AI or cloud tool receives PHI.
Access model. Role-based access, multi-factor authentication and an audit trail are in place.
Incident plan. The vendor has a written incident response procedure and tests it.
Deletion. The vendor documents disposal of files, translation memories and backups.
The ADA tip sheet on business associates notes that business associates, including translation services, can face direct enforcement by the Office for Civil Rights. A weak vendor is therefore a risk for both parties.
What do compliant and non-compliant cases look like?
Case 1: patient discharge summaries. A hospital sends discharge summaries in Spanish and Vietnamese for translation. The hospital signs a BAA, sends files through an encrypted portal, and limits access to two named linguists. The vendor deletes files and memory segments at project end and confirms in writing. This is a standard compliant workflow.
Case 2: clinical study report. A pharmaceutical sponsor needs a study report translated. The sponsor removes participant identifiers before transfer and records the method used. The vendor handles the file under its confidentiality controls. De-identification reduces the PHI exposure.
Case 3: health plan member letters. A health plan sends member letters through a vendor project manager by email. No BAA exists, and a freelancer works on a personal laptop. The plan has disclosed PHI without satisfactory assurances, and nothing governs the freelancer’s device.
Case 4: pasted text in a public AI tool. A reviewer pastes a clinical paragraph into a public online translation tool for a quick check. PHI has reached a third party with no agreement. The vendor must treat this as a possible incident.
What are the common failure modes and mitigations?
Failure mode | Mitigation |
Work starts before the BAA is signed | Make the signed BAA a gate in the project workflow |
Freelancers work without a subcontractor agreement | Hold written agreements and train every linguist before assignment |
PHI persists in translation memories and term bases | Scrub or de-identify segments, set retention limits, delete at project end |
PHI sent by email or consumer file sharing | Use one encrypted transfer channel with access control |
Staff paste PHI into public tools | Block such tools on managed devices, train staff, log tool use |
Over-broad access | Apply role-based access and review permissions at each project close |
Incident not escalated | Write a reporting path and test it with tabletop exercises |
Logs missing after an incident | Keep an audit trail of file access and transfers |
For incident handling, the Security Rule summary on the HHS site states that security incident procedures require business associates to identify, respond to and mitigate the harmful effects of known incidents, and to document the outcomes. The company guide recommends tabletop exercises so reporting channels and timelines are clear before an incident occurs.
What breach notification rules apply to a translation vendor?
The HHS Breach Notification Rule requires a business associate to notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days from discovery. The covered entity may delegate individual notices to the business associate, but it stays ultimately responsible for ensuring that individuals are notified.
A vendor’s report to the covered entity should identify the affected individuals where known, the data involved, the date of the event and discovery, and the steps taken to contain it. The BAA can set a stricter deadline, such as a few business days, and most covered entities do. State breach laws may add duties. Confirm them with counsel.
Perspective: why PHI translation needs controlled AI+HUMAN hybrid workflows
Most PHI exposure in translation comes from process gaps, not from the translation itself. Files move between inboxes, freelancer laptops and public tools. Each hop creates a copy that nobody tracks. We build our approach on the opposite design. Core processing runs on a private, EU-hosted LangOps System, not on outsourced public cloud tooling. Every project uses AI+HUMAN hybrid translation with subject-matter expert review, so a linguist with clinical knowledge checks the output. Our information security is certified to ISO 27001, our AI use and safety to ISO 42001, and we align to HIPAA and GDPR. Regulated buyers should ask vendors the same questions in the same order: who touches the file, where it is processed, what is logged and when it is deleted. A vendor that answers with controls and evidence is easier to audit than one that answers with adjectives. Eric Brown
Where AD VERBUM fits
AD VERBUM is a language service provider with 25+ years of experience, serving Life Sciences, Legal, Finance, Defense and Manufacturing. It uses AI+HUMAN hybrid translation on a proprietary LangOps System hosted on EU servers, with 3,500+ subject-matter expert linguists and 150+ languages. Its certifications include ISO 27001, ISO 42001, ISO 17100, ISO 18587 and ISO 13485, independently audited by Bureau Veritas. It aligns to HIPAA and GDPR. It also integrates client translation memories and term bases. See the translation and localization services.
Key points
A translation vendor that handles PHI for a covered entity is a business associate.
A BAA must be in place before any PHI is disclosed.
Subcontractors and hosting providers that handle ePHI are business associates too.
PHI also lives in translation memories, term lists, screenshots and audio.
De-identification takes data outside PHI, by Safe Harbor or expert determination.
Core controls are encryption, role-based access, multi-factor authentication, an audit trail and documented deletion.
A business associate must report a breach to the covered entity no later than 60 days from discovery. Contracts should set shorter deadlines.
Verify vendor claims through the BAA, risk analysis, subcontractor list and audits.
FAQ
Does every translation vendor need to sign a BAA?
A vendor needs a BAA when it creates, receives, maintains or transmits PHI for a covered entity or for another business associate. If you send only de-identified content, the data is not PHI and HIPAA does not require a BAA for that content. Decide this before the project starts and record the basis.
Is encrypted data still PHI for a hosting provider?
Yes. HHS cloud guidance states that a provider storing encrypted ePHI is still a business associate, even without the encryption key. Encryption lowers risk but does not change the legal status.
Can a translator use machine translation on PHI?
Only inside an environment covered by the BAA and the vendor’s safeguards. A public tool that receives PHI without an agreement is an unauthorized disclosure. Ask the vendor where the system runs, who can access it and whether inputs are retained.
Who notifies patients after a breach at the translation vendor?
The vendor notifies the covered entity. The covered entity is ultimately responsible for notifying individuals, and it may delegate that task to the vendor in writing.
Sources