HIPAA Glossary · Entities & roles
Business associate
Also: BA
A person or organisation that creates, receives, maintains, or transmits PHI on behalf of a covered entity.
Context
Includes cloud hosts, billing firms, analytics vendors, shredding companies, EHR vendors — anyone handling PHI for a covered entity. Directly liable under HIPAA since the 2013 Omnibus Rule, meaning OCR can investigate and penalise business associates in their own right, not just via contract.
Related terms
- BAA — The mandatory contract establishing what a business associate may do with PHI, the safeguards required, and breach reporting duties.
- Subcontractor — A business associate's business associate. Obligations flow downstream: each link in the chain needs its own agreement.
- Covered entity — A healthcare provider that transmits standard electronic transactions, a health plan, or a healthcare clearinghouse.
- Omnibus Rule — The 2013 final rule implementing HITECH — direct business associate liability, the revised breach standard, and updated authorisation requirements.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.