Skip to main content


U.S. flag
      An official website of the United States government
              Here’s how you know
        Here’s how you knowDot gov**Official websites use .gov**
                 A **.gov** website belongs to an official government organization in the United States.
                  HTTPS**Secure .gov websites use HTTPS**
                 A **lock** (A locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. 
  Menu Close
          Enter the terms you wish to search for.
    Search
        








  
  
    

  
      

                                      About HHS
    
                        
                              
      
      
      Programs & Services
    
                        
                              
      
      
      Grants & Contracts
    
                        
                              
      
      
      Laws & Regulations                  
Health Information Privacy
  HIPAA for Individuals
    
                        
                                            
      
      
      Filing a Complaint
    
                        
                                            
      
      
      HIPAA for Professionals
    
                        
                                            
      
      
      Newsroom

              

    



Breadcrumb
    HHS
                              HIPAA Home
                              For Professionals
                              FAQ
                              Business Associates


    

    

    Navigate to:
  Authorizations (30)
          Business Associates (41)
          Compliance Dates (2)
          Covered Entities (14)
          Decedents (9)
          Disclosures for Law Enforcement Purposes (5)
          Disclosures for Rule Enforcement (1)
          Disclosures in Emergency Situations (2)
          Disclosures Required by Law (6)
          Disclosures to Family and Friends (28)
          Disposal of Protected Health Information (6)
          Facility Directories (7)
          Family Medical History Information (3)
          FERPA and HIPAA (10)
          Group Health Plans (3)
          Incidental Uses and Disclosures (10)
          Judicial and Administrative Proceedings (8)
          Minimum Necessary (14)
          Notice of Privacy Practice (20)
          Preemption of State Law (10)
          Privacy Rule: General Topics (12)
          Protected Health Information (2)
          Public Health Uses and Disclosures (13)
          Research Uses and Disclosures (20)
          Right to an Accounting of Disclosures (8)
          Right to File a Complaint (1)
          Right to Request a Restriction (4)
          Safeguards (13)
          Security Rule (24)
          Smaller Providers and Businesses (145)
          Student Immunizations (8)
          Transition Provisions (3)
          Treatment, Payment, and Health Care Operations Disclosures (30)
          Workers Compensation Disclosures (5)
          Limited Data Set (6)
          Marketing (17)
          Marketing - Refill Reminders (16)
          Personal Representatives and Minors (12)
          Right to Access and Research (58)
          Mental Health (35)
          Health Information Technology (41)
          Telehealth (11)Text resize icon

                    




Business Associates
  
  
  
      192-What were the major modifications to the HIPAA Privacy Rule adopted in August 2002
    Based on the information received through public comments, testimony at public hearings, meetings at the request of industry and other stakeholders, as well as other communications, HHS identified a number of areas in which the Privacy Rule, as issued in December 2000, would have had potential unintended effects on health care quality or access.
Read the full answer
      232-Has the Secretary exceeded HIPAA statutory authority by requiring satisfactory assurances
    No. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) gives the Secretary authority to directly regulate health plans, health care clearinghouses, and certain health care providers.
Read the full answer
      236-Is a covered entity liable for the actions of its business associates
    The HIPAA Privacy Rule requires covered entities to enter into written contracts or other arrangements with business associates which protect the privacy of protected health information; but covered entities are not required to monitor or oversee the means by which their business associates carry out privacy safeguards or the extent to which the business associate abides by the privacy requirements of the contract.
Read the full answer
      237-Can business associates self-certify or be certified by a third party as compliant with HIPAA
    No. A covered entity is required to enter into a contract or other written arrangement with a business associate that meets the requirements at 45 CFR 164.504(e).
Read the full answer
      238-Are accreditation organizations business associates of the covered entities they accredit
    Yes. The HIPAA Privacy Rule explicitly defines organizations that accredit covered entities as business associates.
Read the full answer
      239-Is a business associate contract required for a covered entity to disclose information to a researcher
    No. Disclosures from a covered entity to a researcher for research purposes do not require a business associate contract, even in those instances where the covered entity has hired the researcher to perform research on the covered entity’s own behalf.
Read the full answer
      240-When is a health care provider a business associate of another health care provider?
    The HIPAA Privacy Rule explicitly excludes from the business associate requirements disclosures by a covered entity to a health care provider for treatment purposes. See 45 CFR 164.502(e)(1).
Read the full answer
      241-May a covered entity share protected health information directly with another covered entity's business associate
    Yes. If the HIPAA Privacy Rule permits a covered entity to share protected health information with another covered entity, the covered entity is permitted to make the disclosure directly to a business associate acting on behalf of that other covered entity.
Read the full answer
      242-Are covered entities that engage in joint activities under an OHCA required to have contracts
    No. Covered entities that participate in an OHCA are permitted to share protected health information for the joint health care activities of the OHCA without entering into business associate contracts with each other. Of course, each such entity is independently required to observe its obligations under the HIPAA Privacy Rule with respect to protected health information.
Read the full answer
      243-Is a business associate contract required for inadvertent contact with protected health information
    A business associate contract is not required with persons or organizations whose functions, activities, or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all.
Read the full answer
      245-Are USPS, UPS, and delivery employees considered business associates
    No, the Privacy Rule does not require a covered entity to enter into business associate contracts with organizations, such as the US Postal Service, certain private couriers and their electronic equivalents that act merely as conduits for protected health information.
Read the full answer
      246-Does HIPAA require business associates to provide individuals with access to their information
    The Privacy Rule regulates covered entities, not business associates. he Rule requires covered entities to include specific provisions in agreements with business associates to safeguard protected health information, and addresses how covered entities may share this information with business associates.
Read the full answer
      247-Would business associate contracts in electronic form satisfy HIPAA
    Yes, assuming that the electronic contract satisfies the applicable requirements of State contract law.
Read the full answer
      248-Do physicians with hospital privileges have to enter into business associate contracts with the hospital
    No. The hospital and such physicians participate in what the HIPAA Privacy Rule defines as an organized health care arrangement (OHCA).
Read the full answer
      249-May a covered entity contract with a business associate to create a limited data set
    Yes. See 45 CFR 164.514(e)(3)(ii). For example, if a researcher needs county data, but the covered entity’s data contains only the postal address of the individual, a business associate may be used to convert the covered entity’s geographical information into that needed by the researcher.
Read the full answer
      250-Can I combine the data and use agreement and business associate contract
    Yes. A data use agreement can be combined with a business associate agreement into a single agreement that meets the requirements of both provisions of the HIPAA Privacy Rule.
Read the full answer
      251-If a business associate receives a limited data set must they enter into both a business associate agreement and data use agreement
    No. Where a covered entity discloses only a limited data set to a business associate for the business associate to carry out a health care operations function, the covered entity satisfies the Rule’s requirements that it obtain satisfactory assurances from its business associate with the data use agreement.
Read the full answer
      252-Are business associates required to restrict their uses and disclosures to the minimum necessary
    A covered entity’s contract with a business associate may not authorize the business associate to use or further disclose the information in a manner that would violate the HIPAA Privacy Rule if done by the covered entity.
Read the full answer
      253-Is a physician or other provider considered to be a business associate of a health plan or other payer
    Generally, providers are not business associates of payers. For example, if a provider is a member of a health plan network and the only relationship between the health plan (payer) and the provider is one where the provider submits claims for payment to the plan, then the provider is not a business associate of the health plan.
Read the full answer
      254-Is a health insurance issuer or HMO who providing a group health plan a business associate of the group health plan
    A health insurance issuer or HMO does not become a business associate simply by providing health insurance or health coverage to a group health plan.
Read the full answer
      255-Is a reinsurer a business associate of a health plan
    Generally, no. A reinsurer does not become a business associate of a health plan simply by selling a reinsurance policy to a health plan and paying claims under the reinsurance policy.
Read the full answer
      256-Is a software vendor a business associate of a covered entity
    The mere selling or providing of software to a covered entity does not give rise to a business associate relationship if the vendor does not have access to the protected health information of the covered entity.
Read the full answer
      390-Does the HIPAA Privacy Rule require a business associate to create a notice of privacy practices
    However, a covered entity must ensure through its contract with the business associate that the business associate's uses and disclosures of protected health information and other actions are consistent with the covered entity's privacy policies, as stated in covered entity's notice.
Read the full answer
      468-May a covered entity hire a business associate to create a limited data set
    A covered entity may enter into a business associate agreement with the public health authority for the sole purpose of creating a limited data set, even if the same public health authority is also the intended recipient of the information (45 CFR 164.514(e)(3)(ii)).
Read the full answer
      490-When may a provider disclose protected health information to a medical device company representative
    In general, and as explained below, the Privacy Rule permits a covered health care provider (covered provider), without the individual’s written authorization, to disclose protected health information to a medical device company representative (medical device company)
Read the full answer
      494-Were there Privacy Rule compliance deadlines in 2004
    There are two deadlines for compliance with the HIPAA Privacy Rule on April 14, 2004:
Read the full answer
      500-When a covered entity uses a Relay Service is the Relay Service a business associate
    Under the Privacy Rule, a covered entity such as a doctor can contact a patient using a Telecommunications Relay Service (TRS), without the need for a business associate contract with the TRS.
Read the full answer
      709-Must a lawyer who is a business associate require PHI recipients agree to abide by privacy restrictions
    It depends on who the recipient is.
Read the full answer
      760-Must a covered health care provider obtain authorization to use or disclose PHI to an interpreter
    When a covered health care provider uses an interpreter to communicate with an individual, the individual’s authorization is not required when the provider meets the conditions below.
Read the full answer
      2074-May a business associate of a HIPAA covered entity block or terminate access by the covered entity to the protected health information (PHI) maintained by the business associate for or on behalf of the covered entity?
    First, a business associate may not use PHI in a manner or to accomplish a purpose or result that would violate the HIPAA Privacy Rule. See 45 CFR § 164.502(a)(3).
Read the full answer
      2075-May a HIPAA covered entity or business associate use a cloud service to store or process ePHI?
    Yes, provided the covered entity or business associate enters into a HIPAA-compliant business associate contract or agreement (BAA) with the CSP that will be creating, receiving, maintaining, or transmitting electronic protected health information (ePHI) on its behalf, and otherwise complies with the HIPAA Rules.
Read the full answer
      2076-If a CSP stores only encrypted ePHI and does not have a decryption key, is it a HIPAA business associate?
    Yes, because the CSP receives and maintains (e.g., to process and/or store) electronic protected health information (ePHI) for a covered entity or another business associate.
Read the full answer
      2077-Can a CSP be considered to be a “conduit” like the postal service, and, therefore, not a business associate that must comply with the HIPAA Rules?
    Generally, no. CSPs that provide cloud services to a covered entity or business associate that involve creating, receiving, or maintaining (e.g., to process and/or store) electronic protected health information (ePHI) meet the definition of a business associate, even if the CSP cannot view the ePHI because it is encrypted and the CSP does not have the decryption key.
Read the full answer
      2078-Which CSPs offer HIPAA-compliant cloud services?
    OCR does not endorse, certify, or recommend specific technology or products.
Read the full answer
      2079-What if a HIPAA covered entity (or business associate) uses a CSP to maintain ePHI without first executing a business associate agreement with that CSP?
    If a covered entity (or business associate) uses a CSP to maintain (e.g., to process or store) electronic protected health information (ePHI) without entering into a BAA with the CSP, the covered entity (or business associate) is in violation of the HIPAA Rules. 45 C.F.R §§164.308(b)(1) and §164.502(e).
Read the full answer
      2080-If a CSP experiences a security incident involving a HIPAA covered entity’s or business associate’s ePHI, must it report the incident to the covered entity or business associate?
    Yes. The Security Rule at 45 CFR § 164.308(a)(6)(ii) requires business associates to identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the business associate; and document security incidents and their outcomes.
Read the full answer
      2081-Do the HIPAA Rules allow health care providers to use mobile devices to access ePHI in a cloud?
    Yes. Health care providers, other covered entities, and business associates may use mobile devices to access electronic protected health information (ePHI) in a cloud as long as appropriate physical, administrative, and technical safeguards are in place to protect the confidentiality, integrity, and availability of the ePHI on the mobile device and in the cloud, and appropriate BAAs are in place with any third party service providers for the device and/or the cloud that will have access to the e-PHI.
Read the full answer
      2082-Do the HIPAA Rules require a CSP to maintain ePHI for some period of time beyond when it has finished providing services to a covered entity or business associate?
    No, the HIPAA Rules generally do not require a business associate to maintain electronic protected health information (ePHI) beyond the time it provides services to a covered entity or business associate.
Read the full answer
      2083-Do the HIPAA Rules allow a covered entity or business associate to use a CSP that stores ePHI on servers outside of the United States?
    Yes, provided the covered entity (or business associate) enters into a business associate agreement (BAA) with the CSP and otherwise complies with the applicable requirements of the HIPAA Rules.
Read the full answer
      2084-Do the HIPAA Rules require CSPs that are business associates to provide documentation, or allow auditing, of their security practices by their customers who are covered entities or business associates?
    No. The HIPAA Rules require covered entity and business associate customers to obtain satisfactory assurances in the form of a business associate agreement (BAA) with the CSP that the CSP will, among other things, appropriately safeguard the protected health information (PHI) that it creates, receives, maintains or transmits for the covered entity or business associate in accordance with the HIPAA Rules.
Read the full answer
      2085-If a CSP receives and maintains only information that has been de-identified in accordance with the HIPAA Privacy Rule, is it is a business associate?
    No. A CSP is not a business associate if it receives and maintains (e.g., to process and/or store) only information de-identified following the processes required by the Privacy Rule.
Read the full answerBack to top
    Contact HHS
    
                        
                                            
      
      
      Careers
    
                        
                                            
      
      
      HHS FAQs
    
                        
                                            
      
      
      Nondiscrimination NoticeHHS Archive
    
                        
                                            
      
      
      Accessibility Statement
    
                        
                                            
      
      
      Privacy Policy
    
                        
                                            
      
      
      Viewers & PlayersBudget/Performance
    
                        
                                            
      
      
      Inspector General
    
                        
                                            
      
      
      Web Site Disclaimers
    
                        
                                            
      
      
      EEO/No Fear ActFOIA
    
                        
                                            
      
      
      The White House
    
                        
                                            
      
      
      USA.gov
    
                        
                                            
      
      
      Vulnerability Disclosure Policy
        Sign Up for Email Updates

Receive the latest updates from the Secretary, Blogs, and News Releases.

Sign Up
  HHS Headquarters
          200 Independence Avenue, S.W.
                  Washington, D.C. 20201
                  Toll Free Call Center: 1-877-696-6775​