{"head":{"title":"What Is a Business Associate Under HIPAA? | OceanLab","description":"A business associate is a vendor that handles PHI for a HIPAA covered entity. Who counts, what HIPAA asks of them, what it means for software and mistakes.","canonical":"https://oceanlab.in/glossary/business-associate"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"business associate","path":"/glossary/business-associate"}],"slug":"business-associate","term":"Business associate (HIPAA)","aka":["BA","HIPAA business associate"],"category":"Compliance","short":"A person or company that creates, receives, keeps or sends protected health information on behalf of a HIPAA covered entity.","body":[["45 CFR 160.103 defines a business associate as someone who, on behalf of a ",{"href":"/glossary/covered-entity","text":"covered entity"}," and not as part of its workforce, handles ",{"href":"/glossary/phi","text":"PHI"}," for a function or service, such as claims processing, billing, data analysis or IT services. Software vendors, cloud hosts and AI providers that process patient data for a clinic or health plan are common examples."],["A subcontractor that handles PHI for a business associate is also a business associate. Each link in that chain needs a ",{"href":"/glossary/baa","text":"BAA"},", and each must meet the HIPAA Security Rule for the ",{"href":"/glossary/ephi","text":"ePHI"}," it holds."]],"why":["If your software handles PHI for a healthcare customer, you are probably a business associate, and HIPAA applies to you directly: you need safeguards, breach processes and contracts. It also means every vendor in your own data path that touches PHI needs a BAA with you."],"example":["A startup builds a patient intake app sold to physiotherapy clinics. The clinics are covered entities. The startup stores intake forms for them, so it is a business associate. Its cloud host and its email provider, which both touch those forms, are its subcontractors."],"inBuild":["In a health product build this decides the architecture early: which hosting, logging, email and AI services may touch patient data, because each must sign a BAA, and which must be kept away from it."],"mistakes":[["Assuming a vendor is not a business associate because it only stores encrypted data."],["Forgetting analytics, error tracking and support tools that receive PHI by accident."],["Thinking a consumer app the patient signs up for directly is always a business associate. Often it is not."]],"related":[{"href":"/glossary/covered-entity","label":"Covered entity (HIPAA)","detail":"Under HIPAA, a health plan, a healthcare clearinghouse, or a healthcare provider that sends health information electronically in standard transactions."},{"href":"/glossary/baa","label":"BAA (business associate agreement)","detail":"The contract HIPAA requires between a covered entity and a vendor that creates, receives, keeps or sends its PHI."},{"href":"/glossary/phi","label":"PHI (protected health information)","detail":"Health information that can identify a person and is created or held by a HIPAA covered entity or its business associate."},{"href":"/glossary/minimum-necessary","label":"Minimum necessary (HIPAA)","detail":"The HIPAA rule that covered entities and business associates should use, share or request only the PHI needed for the purpose at hand."}],"tools":[{"href":"/tools/hipaa-checklist","label":"HIPAA checklist","detail":"Free tool"},{"href":"/tools/hipaa-risk-assessment","label":"HIPAA risk assessment","detail":"Free tool"}],"links":[{"href":"/compliance/hipaa","label":"HIPAA guide","detail":"Who HIPAA applies to and what it asks of software."},{"href":"/software/clinics","label":"Software for clinics","detail":"Clinic systems, the rules that apply and how they are built."},{"href":"/build/patient-portal","label":"Building a patient portal","detail":"Patient access, records and HIPAA safeguards."},{"href":"/questions/does-my-app-need-hipaa","label":"Does my app need to be HIPAA compliant?","detail":"Question"}],"sources":[{"title":"45 CFR 160.103, Definitions (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103","checkedAt":"2026-10-25"},{"title":"45 CFR 164.502, Uses and disclosures of PHI (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502","checkedAt":"2026-10-25"},{"title":"45 CFR 164.504(e), Business associate contracts (eCFR)","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}