Work out the vendor notice period backwards, starting from what you have already promised your hospital customers. Find the strictest notice period and the widest definition of “change” across your business associate agreements (BAAs). Adjust it by the time your own team needs to review the notice and pass it on (shorter for breach reporting, longer for advance notice of a change), then write the result into the vendor contract as a fixed number of days. HIPAA only sets an outer limit: under 45 CFR 164.410, a business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 calendar days after discovery. HHS has also said that the two parties can agree in their contract when that notification is due. A vendor clause that repeats the 60-day ceiling, or copies your hospital period day for day, gives you no time to act before your own obligation falls due.
What have we already promised our hospitals, and can we buffer it?
Your hospital BAAs set the ceiling. They fix the notice period and the scope of “change” you owe downstream, and no vendor clause can give you more time than those promises leave.
TechnoLynx handles the AI engineering for legal teams side of this review through its AI Governance and Trust work. The first step is an inventory of the model providers, hosting and subprocessors that actually run behind your product, so the change scope you promised hospitals can be checked against the real system.
Read each hospital BAA for four things: the breach-reporting deadline, the advance notice you owe before a subcontractor change, any objection window the hospital holds, and what the agreement counts as a change. The published figures vary a lot. BASG (2026) describes 24 to 72 hours as common in strong BAAs. The HHS model BAA allows up to 30 calendar days for breach notice and five business days for security incidents. One published clause example asks for 30 days’ advance notice of a new or replacement subcontractor that will access PHI, with a 15-day objection window. Others recommend breach notice within 15 business days of discovery, or an initial notice within 14 days and fuller details later.
Different hospitals, different clocks
A workable approach is to take the strictest term separately for each field. That gives you the shortest breach clock from one hospital, the longest advance-notice period from another and the broadest change definition from a third. The vendor clause then has to satisfy all three together. An average across customers will fail at least one of them.
Flowing the same period down removes your buffer
Flowing down the same period is tempting because it looks consistent. If you owe hospitals 30 days and the vendor owes you 30 days, though, every day you spend reading, assessing and drafting comes out of time you have already promised someone else. The decision logic is simple:
- If the vendor can meet a period that leaves you a working buffer, put that period in the vendor contract.
- If the vendor cannot, you have three options. Renegotiate the vendor clause, narrow the commitment in future hospital BAAs, or put an internal mitigation in place for the gap. A contractual right to switch the changed component off is one example.
How long should the vendor notice period be?
The vendor notice period should be your downstream commitment adjusted by a fixed buffer. Which way you adjust depends on the kind of notice.
- Reporting deadlines (breaches, incidents) run after an event. The vendor’s deadline to you must be shorter than your deadline to the hospital: vendor deadline = hospital deadline minus buffer.
- Advance notice (a new subprocessor, a model change) runs before an event. The vendor’s lead time to you must be longer than the lead time you owe the hospital: vendor lead time = hospital lead time plus buffer.
Mixing up the two is the easiest way to sign a clause that looks protective and isn’t. AccountableHQ recommends that BAAs set tighter internal notice clocks for subcontractors, for example 5 to 10 days, so the upstream party has time to meet its HIPAA deadlines. The buffer itself is a drafting choice, sized to your own steps: legal review, an update to the risk analysis (which should cover the AI vendor and its subprocessors before go-live), and customer communications.
When the clock starts
A HIPAA breach counts as discovered on the first day it is known, or would have been known with reasonable diligence, to any employee, officer or agent other than the person who committed it. Depending on the agency relationship, a vendor’s knowledge can be treated as yours from day one. In practice, your buffer is measured from the vendor’s discovery date, not the day its email reaches you. A BAA guide from the AI vendor Claire notes that a clause running from a “confirmed” breach can delay notice by weeks or months while forensics continue, so tie the clause to discovery.
Worked example: three clocks, using published figures
The figures below come from the sources named in each cell. Pairing the figures and doing the arithmetic is this article’s own illustration.
| Downstream promise (hospital BAA) | Upstream term (vendor to you) | What is left for you |
|---|---|---|
| Breach notice within 30 calendar days (HHS model BAA figure) | Breach notice within 5 to 10 days (AccountableHQ recommendation) | 20 to 25 days for investigation and hospital notice |
| Breach notice within 72 hours (the 24-72 hour range BASG describes as common) | Breach notice within 5 to 10 days | Negative: the vendor clock must be in hours, not days |
| 30 days’ advance notice of a subprocessor change, 15-day objection window (published clause example) | 30 days’ notice of a new AI subprocessor (Microsoft DPA) | Zero: you learn of the change exactly when your own notice is due |
The second row shows that a sensible-sounding rule of thumb breaks once you have promised hours downstream. The third row’s upstream term is not hypothetical. Microsoft’s Data Protection Addendum commits to at least six months’ notice of a new subprocessor that processes Customer Data, but only at least 30 days for subprocessors that support AI functionality. Customers can disable such a subprocessor for at least six months after notice. PPC Land reports that this shorter AI track arrived in the DPA update of 22 May 2026, replacing the previous six-month minimum. The Microsoft terms are a GDPR-oriented DPA, not a BAA, but they show that an upstream vendor can shorten notice, and your buffer goes with it. The disable right is the kind of internal mitigation that can close a gap like this, provided your product can actually run without that component.
Which vendor changes should trigger the notice clause?
The vendor’s list of triggers must include everything you have to report downstream, and can include more. Any change you owe a hospital notice of, but the vendor owes you none for, is a gap you will only find later. The sources name these triggers:
- Adding or replacing a subcontractor that will access PHI. Many contracts list current material subcontractors and require notice before a change, sometimes with a right to object or terminate.
- Changes to the model or infrastructure subprocessor list. Linear Health suggests identifying model and infrastructure subprocessors and requiring notice whenever that list changes.
- AI-specific subprocessors. In Microsoft’s case these can include the companies providing the underlying language models, the infrastructure running AI services, safety evaluation tools and agentic orchestration layers.
- Scope changes. This covers new systems, data types or processing locations for ePHI.
- Changes to ownership, corporate structure or primary hosting environment.
- Lost certifications or major system updates.
Notice has to arrive before the change, not after. Compare the HHS model BAA, which only requires notice of a subcontract within 30 calendar days of its execution, posted on the business associate’s website. That is useful for record-keeping but no help for go-live planning. Promise Legal (2026) argues for written notice “with a meaningful window, not 24 hours” before a new subcontractor is onboarded.
From an engineering standpoint, the hardest trigger is the quiet one. A hosted inference endpoint can switch foundation model behind an unchanged API, and a generic BAA says nothing about model changes unless the parties add it. The clause only works if the vendor keeps a list your team can check. One AI vendor publishes entries that give each subprocessor’s name, role, data categories, data centre locations and BAA status, and updates the list within 10 business days of a change. Which disclosures to demand at signature is part of the wider security, compliance and contractual due diligence for LLM vendor procurement.
Flow-down: the chain has to reach the model provider
A notice period only protects you if it reaches the party that makes the change. HHS’s sample provisions require the business associate to ensure that any subcontractors with access to PHI agree to the same restrictions and conditions that apply to it. Since the 2013 Omnibus Rule, a subcontractor handling PHI is a business associate in its own right. For AI products, that can mean the cloud host, the model inference provider, the logging platform and the support system, each needing its own BAA coverage. BASG reports that OCR has pursued cases where the covered entity’s BAA was compliant but the business associate failed to impose equivalent terms on its subcontractors. Your vendor’s contracts with its own subprocessors therefore need notice terms at least as tight as the ones the vendor gives you. Otherwise your buffer exists on paper only.
Who can help us map the AI changes our notice clause has to cover?
TechnoLynx delivers this as approval evidence packs under AI Governance and Trust.
Register checks and the wording that defeats them
Use these checks on each executed BAA, both downstream with hospitals and upstream with vendors:
- Breach timeline recorded as agreed. BASG lists the agreed breach notification timeline and the presence of subcontractor flow-down language among the fields a BAA register should hold.
- No reliance on the 60-day baseline. A BAA that relies on HIPAA’s 60-day window with no tighter negotiated timeline is a named failure mode. Long windows in the BAA translate directly into compressed response time for the covered entity.
- Clock tied to discovery, not confirmation.
- “Reasonable notice” replaced with a number. Generic “reasonable notice” language effectively allows subprocessor substitutions without your knowledge, so define it in days.
- Advance-notice period longer than your downstream promise. Check this in the opposite direction to the breach clock.
- Change definition at least as broad as the one you owe hospitals.
- Equivalent flow-down to the vendor’s own subprocessors.
The numbers need revisiting as vendors and laws change. AccountableHQ advises updating a BAA when a vendor or subcontractor changes and at renewal, and pausing go-live on new PHI uses until the BAA reflects the new scope. That pause is the real test of your vendor notice period. If the period is long enough, a model or subprocessor change reaches your hospital customers before go-live. If it is too short, the change goes live first and the notice follows.
