What happens to your data when you leave a vendor
Practices spend weeks choosing a vendor and about five minutes planning how to leave one. Yet every vendor that touched patient information still holds some of it on the day you cancel. HIPAA sets clear expectations for what happens next, and a little planning turns a messy exit into a routine one. This is general information, not legal advice.
- Every Business Associate Agreement must require the vendor to return or destroy patient information at termination, or protect what it cannot (45 CFR 164.504(e)(2)(ii)(J)).
- Backups, logs and the vendor's own subcontractors hold copies too. Ask about all of them.
- Get your data out in a usable format before access ends, and get written confirmation of destruction after.
- Plan for the exit when you sign, not when you leave.
What HIPAA requires at the end
The required terms of a Business Associate Agreement, set out in 45 CFR 164.504(e)(2), include a specific exit clause. At termination, the business associate must return or destroy all PHI it received from the practice, or created or received on the practice's behalf, and keep no copies, if that is feasible.
If return or destruction is not feasible, the BAA must require the vendor to extend the protections of the contract to the information it keeps and limit further uses and disclosures to the purposes that make return or destruction infeasible. In other words, data the vendor cannot delete stays under HIPAA-level protection for as long as it exists.
The same obligation flows down. Under 45 CFR 164.502(e) and 164.504(e), the vendor's subcontractors, such as its cloud host or messaging provider, must agree to the same restrictions and conditions, which include handling PHI properly when the relationship ends.
Where your data actually lives inside a vendor
"We deleted your account" can mean many things. Patient information at a typical software vendor may sit in several places at once:
- The live database behind the product.
- Backups, often kept on a rolling schedule for weeks or months.
- Logs of messages sent, calls handled or files processed.
- Uploaded files, such as schedule exports or patient lists.
- Subcontractors: hosting providers, messaging carriers' platforms, AI model providers, support ticket tools.
- Reports and exports emailed to your staff, which now sit in your own inboxes.
What "destroy" should mean
HHS guidance on securing PHI points to NIST Special Publication 800-88, Guidelines for Media Sanitization, as the standard for destroying electronic PHI so that it cannot be retrieved. Information destroyed in line with that guidance is no longer considered unsecured for breach notification purposes.
For cloud software, ask the vendor to describe in plain words how deletion works: when records are removed from the live system, when backups containing them expire, and how subcontractors are instructed to delete. Then ask for a written certificate or letter confirming destruction once it is complete.
What you need to keep
Leaving a vendor does not end your own record-keeping duties, so get what you need out first.
Medical records. The HIPAA Privacy Rule does not set a retention period for medical records; HHS points practices to state law, which varies. Make sure any part of the record that lives only in the vendor's system is exported before you leave.
HIPAA documentation. Policies, procedures and other required documentation must be kept for six years from creation or the date last in effect, whichever is later (45 CFR 164.530(j)). Keep the signed BAA, termination notices and the vendor's destruction confirmation in your compliance file.
Operational records. Message logs, opt-out lists and consent records may be needed if a patient ever disputes a text. Export opt-out and consent lists in particular, so your next system honors them from day one.
The exit checklist
Work through these steps in order. Most can be done in a week or two with a cooperative vendor.
- Re-read the BAA and contract. Find the termination clause, notice period, data return clause and any fees for exports.
- Request an export. Ask for your data in a standard, documented format, such as CSV, along with a description of each field. Confirm it opens and is complete before access ends.
- Export suppression lists. Opt-outs and contact preferences should move to your next system immediately.
- Settle phone numbers. If patients text a number the vendor provisioned, find out whether you can port it. Losing the number patients recognize causes confusion and missed replies.
- Cut access. Disable integrations, revoke API keys and shared logins, and remove the vendor's access to any of your systems.
- Instruct return or destruction in writing. Reference the BAA clause, ask about backups and subcontractors, and set a date.
- Get confirmation. Request a signed statement that PHI was destroyed or returned, or a description of what was retained and why, with continued protections.
- File it all. Keep the paper trail for at least six years.
Questions to ask before you sign the next one
The best time to plan an exit is at the start, when you have leverage. Before signing with any vendor that will handle PHI, ask:
- In what format can we export all of our data, and is there a fee?
- How long after termination do we keep access to export?
- How long do backups persist after deletion?
- Which subcontractors hold copies, and how are they instructed to delete?
- Will you provide written confirmation of destruction?
- Who owns the phone numbers or email domains used to contact our patients?
DocsMD starts with a BAA and a light footprint
DocsMD works from the schedule export your EHR already produces, with no installation and no access to your systems, so there is nothing to uninstall. A Business Associate Agreement is signed with every practice before any patient data moves, data is encrypted at rest and in transit in U.S. data centers, and patient data is never used to train AI. Read the details on our HIPAA and BAA page.
Questions
Can a vendor keep our patient data after we cancel?
Only where return or destruction is not feasible, and then the BAA must extend its protections to that data and limit further use. Otherwise the vendor must return or destroy it.
Does the vendor have to delete backups too?
The return-or-destroy requirement covers all PHI the vendor holds, which includes backups. Backups often expire on a schedule rather than instantly, so ask the vendor for the timeline and confirm the data stays protected until then.
How long must we keep patient records ourselves?
HIPAA itself does not set a medical record retention period; state law does, and it varies. HIPAA does require you to keep compliance documentation, such as BAAs, for six years.
What if the vendor goes out of business?
Their obligations under the BAA do not disappear, but enforcing them gets harder. That is why exporting your data regularly and choosing vendors that store data in standard formats matters. This article is general information, not legal advice.