HIPAA Glossary · Entities & roles
Subcontractor
A business associate's business associate. Obligations flow downstream: each link in the chain needs its own agreement.
Context
The HITECH Act and Omnibus Rule extended HIPAA's reach down the vendor chain. A business associate's subcontractors that create, receive, maintain, or transmit PHI must sign downstream agreements with terms at least as protective. Flow-down obligations are a frequent gap — teams track their own BAAs but not the subcontractor chain below them.
Related terms
- Business associate — A person or organisation that creates, receives, maintains, or transmits PHI on behalf of a covered entity.
- BAA — The mandatory contract establishing what a business associate may do with PHI, the safeguards required, and breach reporting duties.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.