Business Associates and Third-Party Relationships
The Business Associate Relationship
A business associate is a person or entity that performs functions or activities on behalf of a covered entity involving PHI-such as claims processing, data analysis, billing, or IT support-or that provides legal, actuarial, accounting, consulting, or other services involving PHI. A written business associate agreement (BAA) is required before PHI is shared. The BAA must establish permitted uses and disclosures, require safeguards, require breach reporting, require downstream BAAs with subcontractors, and address return or destruction of PHI at termination.
Direct Liability
Business associates are directly liable for certain Security Rule and Privacy Rule obligations, including safeguards, breach notification, and limits on use and disclosure. Subcontractors that create, receive, maintain, or transmit PHI on behalf of a business associate are themselves business associates and require a BAA.
Traps Candidates Miss
- A conduit is not a business associate. Entities that merely transmit PHI, such as the postal service or an internet service provider, without accessing it, are excluded.
- A covered entity disclosing to a provider for treatment is not a BA relationship; treatment disclosures do not require a BAA.
- A BAA is not a substitute for authorization where authorization is required.
- Termination obligations require return or destruction, with documentation if destruction is infeasible.
Rule of Thumb
Ask whether the third party accesses PHI to perform a service for the covered entity. If yes, a BAA is required; if the party only transports data without accessing it, it is likely a conduit.
Worked Example
A hospital contracts with a cloud vendor to store ePHI. Because the vendor maintains PHI on the hospital's behalf, it is a business associate and a BAA is required, even though the vendor does not read the records.