Business associate (HIPAA)
Also called BA, HIPAA business associate.
A person or company that creates, receives, keeps or sends protected health information on behalf of a HIPAA covered entity.
Last updated
What it is.
45 CFR 160.103 defines a business associate as someone who, on behalf of a covered entity and not as part of its workforce, handles PHI for a function or service, such as claims processing, billing, data analysis or IT services. Software vendors, cloud hosts and AI providers that process patient data for a clinic or health plan are common examples.
A subcontractor that handles PHI for a business associate is also a business associate. Each link in that chain needs a BAA, and each must meet the HIPAA Security Rule for the ePHI it holds.
Why it matters
If your software handles PHI for a healthcare customer, you are probably a business associate, and HIPAA applies to you directly: you need safeguards, breach processes and contracts. It also means every vendor in your own data path that touches PHI needs a BAA with you.
In a product build
In a health product build this decides the architecture early: which hosting, logging, email and AI services may touch patient data, because each must sign a BAA, and which must be kept away from it.
Common mistakes.
- 01
Assuming a vendor is not a business associate because it only stores encrypted data.
- 02
Forgetting analytics, error tracking and support tools that receive PHI by accident.
- 03
Thinking a consumer app the patient signs up for directly is always a business associate. Often it is not.
Read the official text.
Primary sources this definition is based on.
- 45 CFR 160.103, Definitions (eCFR)checked 2026-10-25
- 45 CFR 164.502, Uses and disclosures of PHI (eCFR)checked 2026-10-25
- 45 CFR 164.504(e), Business associate contracts (eCFR)checked 2026-10-25
Work it out with a tool.
Related terms.
- Covered entity (HIPAA)Under HIPAA, a health plan, a healthcare clearinghouse, or a healthcare provider that sends health information electronically in standard transactions.
- BAA (business associate agreement)The contract HIPAA requires between a covered entity and a vendor that creates, receives, keeps or sends its PHI.
- PHI (protected health information)Health information that can identify a person and is created or held by a HIPAA covered entity or its business associate.
- Minimum necessary (HIPAA)The HIPAA rule that covered entities and business associates should use, share or request only the PHI needed for the purpose at hand.
