Business Associate
Any outside vendor that handles protected health information on a healthcare organization's behalf.
What is a Business Associate?
A business associate is any person or organization outside your workforce that creates, receives, maintains, or transmits protected health information (PHI) to perform a service on behalf of a HIPAA-covered entity. Common examples include billing companies, IT providers, cloud storage vendors, and EHR platforms. Under HIPAA, business associates are legally required to protect the PHI they handle.
How It Works
Under HIPAA, a covered entity such as a medical practice cannot simply hand patient data to an outside vendor and hope it is protected. When a vendor performs a function that involves PHI, that vendor becomes a business associate and takes on legal responsibility for safeguarding the data.
This relationship is formalized through a Business Associate Agreement (BAA), a written contract required before any PHI is shared. The BAA obligates the business associate to protect the data, report breaches, limit how the data is used, and return or destroy it when the relationship ends.
Importantly, the obligations flow down the chain. If a business associate hires a subcontractor who also handles the PHI, that subcontractor becomes a business associate too and must sign its own agreement. Since 2013, business associates have been directly liable under HIPAA for protecting the data they touch.
Why It Matters
Business associates are one of the largest sources of healthcare breaches, because your patient data is only as secure as the vendors who handle it. When a vendor is compromised, your data goes with it, and your practice can share the liability. Identifying every business associate, keeping signed agreements in place, and verifying their safeguards is essential to protecting both your patients and your organization.
Related Terms
For a complete guide, read our full article on the business associate agreement explained for medical practice owners.
SecTec helps healthcare organizations manage business associate relationships as part of our HIPAA compliance service.
Years Protecting Businesses
BAA Coverage on Healthcare Engagements