What Is a HIPAA Business Associate?

A business associate is a person or organization, other than a workforce member, that creates, receives, maintains, or transmits protected health information on behalf of a covered entity, or provides certain services to it that involve PHI. Billing companies, claims processors, IT vendors and consultants can be business associates when their functions or services meet the definition. Subcontractors handling PHI for a business associate are also business associates.

Definition. Under 45 CFR 160.103, a business associate performs a function or activity involving PHI on behalf of a covered entity, such as claims processing, data analysis, utilization review, quality assurance, or billing. The definition also covers those who provide legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services involving the disclosure of PHI.

Subcontractors. Subcontractors that create, receive, maintain or transmit PHI on behalf of a business associate are also business associates, subject to the definition's workforce limitation.

Who is not a business associate. A covered entity's own workforce members are not business associates. HHS guidance also explains that a health care provider receiving PHI for treatment is not a business associate of the disclosing provider, and that conduits that only transmit information, such as the postal service, generally are not business associates. HHS limits the conduit exception to entities that only transmit PHI, including any temporary storage incident to transmission; entities that access PHI on a regular or frequent basis to perform a service are not conduits.

Dual roles. A covered entity may be a business associate of another covered entity (45 CFR 160.103).

Direct liability. Business associates must comply with the Security Rule and are directly liable for certain Privacy Rule and Breach Notification Rule requirements (45 CFR 164.502(a)(3), 164.410).

Note. Learn Laws® is a training company, not a law firm. This FAQ summarizes federal rules for general information and is not legal advice. HHS and OCR do not endorse any private consultants' or education providers' seminars, materials or systems, and do not certify any persons or products as "HIPAA compliant."