HIPAA Compliance for Translation Agencies: U.S. Checklist

What to take away

A translation agency must sign a business associate agreement (BAA) before it creates, receives, maintains, or transmits protected health information for a covered entity.
HIPAA is a federal floor; stricter state statutes, municipal contract clauses, and private health system policies can add separate duties.
A skipped BAA or loose PHI handling can draw OCR civil money penalties, corrective action plans, and notice duties after a breach.
A defensible file contains a signed BAA, a security risk assessment, access and encryption policies, workforce training logs, and a breach response plan.

Who has jurisdiction over medical translation

HHS enforces HIPAA through the Office for Civil Rights (OCR). The federal rules apply to covered entities and to their business associates, a status translation agencies often trigger. HHS guidance on business associates explains that an agency handling PHI for a hospital or clinic must sign a BAA. State attorneys general and state health departments enforce separate medical privacy statutes, and some states add stricter consent or breach rules.

Four Rule Layers

Rule layer

Federal HIPAA/HITECH: HHS OCR
State medical privacy: State AG/health dept
Municipal contract clause: City/county health dept
Private client standard: Covered entity/accreditor

Enforcer

Federal HIPAA/HITECH: BAA, safeguards, breach notice
State medical privacy: Stricter consent, breach timelines
Municipal contract clause: Confidentiality, audit terms
Private client standard: Questionnaires, policy attestations

Adds for agencies

Federal HIPAA/HITECH
State medical privacy
Municipal contract clause
Private client standard

Four rule layers can reach a translation agency on the same patient record.

Enforcer

Federal HIPAA and HITECH: HHS Office for Civil Rights
State medical privacy law: State attorney general or health department
Municipal contract clause: City or county health department
Private client standard: Covered entity, health system, or accreditor

What it adds for translation agencies

Federal HIPAA and HITECH: BAA, Security Rule safeguards, breach notification duties
State medical privacy law: Stricter consent, access, or breach timelines, such as California's CMIA
Municipal contract clause: Added confidentiality and audit terms in public health programs
Private client standard: Security questionnaires, policy attestations, subcontractor limits

The federal rule is the floor. A stricter state law, a county contract term, or a private hospital policy can add duties without replacing HIPAA.

What triggers business associate status

The trigger is PHI access, not the word "translation." If an agency receives a hospital discharge instruction, a lab report, or a recorded clinical visit to translate, it is handling PHI on behalf of a covered entity. OCR's minimum necessary guidance says an agency may use only the minimum needed for the assignment. A vendor that sees only de-identified data or works from a public brochure may not need a BAA, but many health clients require one anyway as a contract term.

For staff who are new to PHI work, new translation agency employee covers onboarding controls.

What to submit: BAA and compliance evidence

There is no federal permit for translation agencies. Instead, a covered entity will ask for a signed BAA and evidence that the vendor can protect PHI. Keep a package ready: a signed BAA with subcontractor terms, a written security risk assessment, and access, encryption, and disposal policies. Add training logs for every worker who touches PHI and a breach response plan. HHS security guidance outlines the security documentation OCR expects.

How long approval takes

HIPAA has no agency certification or license to wait for. A covered entity's vendor review commonly takes two to four weeks when a security questionnaire and policy review are involved. If OCR opens a complaint investigation, the process can run for several months before a closure letter or resolution agreement. State health department contract approvals may take longer when a municipal agency requires its own privacy addendum.

A health client that doubts the agency's privacy controls may become a churn risk, as Six churn reasons compared explains.

What happens if you skip it

Skipping a BAA does not remove HIPAA duties; it creates evidence of non-compliance. OCR can open a compliance review, impose a civil money penalty, and require a corrective action plan. HHS breach notification requires a business associate to notify the covered entity after discovering a breach of unsecured PHI, and large breaches trigger notice to the secretary and media. State attorneys general may also sue for damages or injunctions.

Agencies that also work across national borders should check the tax and contract points before signing a health client master agreement.

HIPAA compliance checklist for translation agencies

Sign a BAA with each covered entity client before receiving PHI, and name all subcontractors that will touch PHI.
Keep a written security risk assessment that covers devices, file transfer, email, and remote work.
Limit translator access to the minimum necessary PHI for each assignment and revoke access when the job ends.
Use encryption for stored and transmitted electronic PHI, and log access to project files.
Train every translator and project manager on HIPAA basics, breach reporting, and phishing before they handle PHI.
Maintain a breach response plan with named contacts, 60-day internal deadlines, and a process to notify the covered entity.
Review state and municipal privacy addenda before accepting public health or county hospital work.
Keep signed BAAs and training records for at least six years after the relationship ends.

For documents outside HIPAA, such as visa petitions, review Certified Translations for USCIS Petitions.

HIPAA Compliance Checklist

Sign BAA before receiving PHI
Keep written security risk assessment
Limit translator access to minimum necessary
Encrypt stored and transmitted ePHI
Train translators and project managers
Maintain breach response plan
Review state and municipal addenda
Keep records six years after end

Common questions

Does a translation agency need a BAA if it only translates de-identified data?

No. A BAA is required only when the agency creates, receives, maintains, or transmits PHI for a covered entity. De-identified data does not trigger HIPAA, but the client may still require a BAA by contract.

What happens if an agency uses a freelancer translator for PHI?

The agency must have a business associate agreement with that freelancer or include the freelancer under the agency's own BAA as a subcontractor. The covered entity's BAA should permit subcontractors.

How long must a translation agency keep HIPAA records?

HIPAA requires documentation, including BAAs and policies, to be retained for six years from the date of creation or last effective date, whichever is later.

Can a state fine a translation agency for a HIPAA breach?

State attorneys general can sue under HIPAA for damages and injunctions, and state privacy laws may carry their own penalties. A state medical privacy law can add requirements above the federal floor.