Your compliance officer has a vendor questionnaire open, and one box reads: "Is the translation vendor HIPAA compliant?" The sales rep ticked yes. A "HIPAA compliant" badge sits on the vendor's website. Nobody has asked for the one document that actually matters, and discharge summaries, lab reports and consent forms are already moving through the vendor's inbox.
Here is the misconception to fix first: there is no such thing as a "HIPAA certified" translation vendor. HHS does not certify or endorse vendors, and a badge is marketing. What exists is a legal relationship, the business associate relationship, and a written contract that governs it. This guide is a set of questions to put to any translation or interpretation provider before protected health information (PHI) reaches them.
When a Language Vendor Becomes a Business Associate
The definition in 45 CFR §160.103 turns on function, not on the vendor's industry. A person or company outside your workforce that performs a service for you involving PHI is a business associate. Translation fits on its face: the document you send is the PHI.
Three situations come up constantly:
- Document translation. Medical records, discharge instructions, pathology reports and intake forms contain names, dates of birth, diagnoses and record numbers. The vendor receives and maintains PHI. BAA required.
- Interpretation during a patient encounter. An interpreter on the phone, on video or in the exam room hears PHI as the service is delivered. Unless the interpreter is part of your own workforce under your direct control, the interpreting company is handling PHI on your behalf.
- Scheduling and billing contacts. Appointment details tied to a patient and a language need are themselves PHI once they identify the individual and relate to care.
Two common arguments for skipping the BAA do not hold up well. "The files are encrypted" does not remove the relationship if the vendor opens, works on, or stores them. And "we only hold the document for a day" does not either; the test is whether the vendor handles PHI for you, not for how long. The narrow conduit exception covers pure transmission services, such as a carrier moving data without routine access to it. A translation company reading your document is not a conduit.
The Villain: The Questionnaire Checkbox
The real enemy here is procurement by checkbox. A vendor says "HIPAA compliant," a buyer accepts it, and the covered entity discovers the gap only when something goes wrong, at which point the covered entity answers to OCR for the missing agreement. Related failures follow the same pattern: sending a full chart to a translator when only one page was needed, letting an untrained bilingual employee's personal email carry a document, or routing a file through a free machine-translation website that has no agreement with anyone.
What a BAA Must Actually Cover
45 CFR §164.504(e)(2) lists the required contents. For a language vendor, here is what each element means in practice:
| BAA element | What to look for in a translation or interpretation contract |
|---|---|
| Permitted uses and disclosures | Limited to performing the language service. No secondary use, no use of your content to train machine-translation engines or build a vendor's own datasets. |
| Safeguards | The vendor commits to appropriate safeguards and to complying with the Security Rule for electronic PHI, which applies to business associates directly. |
| Reporting | Duty to report any use or disclosure not allowed by the contract, including security incidents and breaches. Under §164.410 a business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 calendar days after discovery. Many covered entities contract for something much shorter. |
| Subcontractors | Written agreement that anyone the vendor engages to handle PHI accepts the same restrictions and conditions. |
| Individual rights support | Access to, amendment of, and accounting of disclosures for PHI the vendor holds, where applicable. |
| Books and records | Make internal practices available to HHS for compliance determinations. |
| Termination and return | At contract end, return or destroy PHI where feasible, and be able to show you how. Ask for written confirmation. |
The Freelancer Problem: Subcontractor Flow-Down
Most language companies do not translate in-house. The work goes to a network of freelance linguists, reviewers and proofreaders. Under the HIPAA rules, a subcontractor that handles PHI for a business associate is itself a business associate, and the vendor must have a compliant agreement with each one (§164.502(e)(1)(ii) and §164.504(e)(5)).
A BAA signed with the project manager does not protect you if the file lands in a freelancer's unmanaged laptop folder. Ask directly:
- Does every linguist who sees PHI sign a written agreement with equivalent terms before access?
- Are files delivered through a controlled platform, or by email attachment?
- Can the vendor tell you who handled your file, and when?
Have a vendor agreement to review, or a document you need translated without a compliance gap? We sign a BAA before any PHI is shared.
Minimum Necessary, Applied to Source Documents
The minimum necessary standard (§164.502(b)) generally applies when you disclose PHI to a business associate. For language work this means a translator rarely needs the entire chart. If you need a single discharge summary translated, send that summary, not the whole record. If a consent form only needs the template translated, send the blank template; the patient's name and identifiers add nothing. Redacting fields the translation does not depend on is cheap, and it narrows what any incident could expose.
One caution: do not redact so aggressively that the translator loses context the translation needs, such as a medication name or a dosage. Decide what is needed, then send that.
Interpreter Confidentiality Is a Separate Question
For interpretation, ask about the people as well as the paper. Interpreters should be bound by written confidentiality obligations, trained on privacy, and, for remote services, working over a platform that does not record or retain encounters unless you ask it to. If calls are recorded, ask where the recordings live, who can listen, and how long they are kept. Section 1557 also expects a qualified interpreter rather than an ad hoc one; our guide to what actually counts as a qualified interpreter covers that side.
Your 3-Step Plan
- Map the data. List every language workflow that touches PHI: document translation, interpretation, captioning of patient-education video, website forms. Identify which vendors are involved in each, including any machine-translation tools staff use on their own.
- Get the paper before the files. Require a signed BAA covering the elements above, plus a written answer to the freelancer, platform, retention and incident-reporting questions. Do not accept a security badge in place of an agreement.
- Send the minimum, track the rest. Share only what the job needs, deliver through a controlled channel, and set a retention and return-or-destroy date at the start of each engagement.
Get this right and a language request becomes routine: the patient gets an accurate translation, and your file shows a signed agreement, a defined data path and a documented process if OCR or an auditor ever asks. Skip it and you carry the exposure yourself, for a vendor relationship that was supposed to reduce risk.
For the broader compliance picture, including when machine translation is and is not acceptable, see our guide to HIPAA-compliant medical translation. If you are reviewing a health-system language program as a whole, our healthcare language access page lays out the services.
Why Work With Taika
Language Access Hub, powered by Taika Translations, is a veteran-owned, GSA- and NASPO-contracted language access provider with ATA-certified linguists. We execute a signed Business Associate Agreement with healthcare clients before any PHI is shared, and we are glad to be asked the questions in this article. Send us your vendor questionnaire and we will answer it in writing.
This article is general information about HIPAA requirements and is not legal advice. Have your privacy officer or counsel review any BAA before signing.