HIPAA Business Associates: Security Rule Compliance Guide

Business associates (BAs) handle protected health information (PHI) on behalf of covered entities or other BAs. Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), they must comply with applicable Privacy Rule and Breach Notification Rule provisions. For electronic PHI (ePHI), they must also meet the HIPAA Security Rule requirements.

BA status depends on the services performed and whether they involve creating, receiving, maintaining, or transmitting PHI, according to Department of Health and Human Services (HHS) business associate guidance. Organizations that store PHI on behalf of covered entities or other BAs may qualify, even without access to readable patient data.

This guide covers what counts as a BA, which HIPAA Security Rule requirements apply, what a business associate agreement (BAA) needs to include, how liability extends to subcontractors, and how to manage vendor risk in 2026.

Assess your business associates’ safeguards against HIPAA Security Rule requirements.

Map all 70 HIPAA Security Rule citations to existing controls across NIST 800-66, 800-53, CSF 2.0, HITRUST, and the HHS SRA Tool, with framework mappings, assessment questions, and implementation specifications, all in one place.

Access the HIPAA Security Rule Crosswalk →

What Is a HIPAA Business Associate?

A HIPAA business associate (BA) performs specified functions or services involving PHI for a covered entity or another BA. The Code of Federal Regulations (CFR) defines the role and its exceptions in 45 CFR § 160.103.

A HIPAA business associate performs specified functions or services involving protected health information for a covered entity, outside its workforce. Qualifying subcontractors that handle PHI for another business associate are also BAs. The definition has exceptions, including a provider receiving information to treat a patient.

Three definitions help determine whether the relationship falls within that scope:

Protected health information: Individually identifiable health information covered by HIPAA, including information about health, care, or payment for care.
PHI formats: BA status can involve electronic, paper, or spoken PHI; the Security Rule applies to ePHI.
Covered entities (CEs): Health plans, healthcare clearinghouses, and healthcare providers that transmit health information electronically in connection with HIPAA-covered transactions.

For example, a cloud provider storing encrypted ePHI for a covered entity or another BA qualifies as a BA, even without the decryption key. Depending on their contracted activities, software support vendors that access PHI, transmission services that retain ePHI beyond temporary storage, and document-destruction vendors receiving paper PHI may also qualify.

For more on how BA status applies to cloud services, see the HHS cloud-computing guidance.

Do Business Associates Have to Comply with the Security Rule?

Business associates and covered entities must comply with the HIPAA Security Rule’s applicable requirements for ePHI.

Before 2009, a BA’s security obligations primarily came through its contract with the covered entity. That changed when the Health Information Technology for Economic and Clinical Health (HITECH) Act made compliance a direct legal duty via § 13401, codified at 42 U.S. Code § 17931.

Today, the HHS Office for Civil Rights (OCR) publishes the HIPAA provisions that apply directly to BAs in its direct-liability guidance. It explicitly lists failure to comply with the Security Rule as a violation, which can lead to OCR investigations and, in the most serious cases, penalties reaching approximately $2.19 million per violation.

How Business Associates Comply with the HIPAA Security Rule

Business associates comply with the Security Rule by implementing applicable HIPAA safeguards and meeting the Rule’s organizational and documentation requirements. That includes:

Administrative safeguards: Under 45 CFR § 164.308, BAs must carry out risk analysis, risk management, security training, contingency planning, and other administrative measures to manage security practices and workforce conduct around ePHI.
Physical safeguards: To keep the systems and equipment holding ePHI physically secure, § 164.310 requires BAs to control facility access, protect workstations, and set procedures for devices and media.
Technical safeguards: BAs must put access controls, audit controls, integrity protections, authentication, and transmission security in place to control who can reach ePHI, as set out in § 164.312.
Organizational requirements: BA contracts must commit to Security Rule compliance and security incident reporting under § 164.314, and must ensure any subcontractors handling ePHI agree to the same requirements.
Policies and documentation: Finally, § 164.316 requires BAs to maintain written policies and procedures, which may be electronic, and records of actions, activities, or assessments that the Security Rule requires to be documented.

Those records also need to stay on file for six years from the date they were created or last in effect, whichever is later. That period applies only to compliance records, and is separate from the state laws that govern how long patient records are kept. A BA may need to follow one timeline for its HIPAA documentation and a different one for the PHI it holds.

Our HIPAA Security Series provides additional context on the safeguard categories and documentation practices.

HIPAA Breach Notification Requirements for Business Associates

The HIPAA Breach Notification Rule applies to unsecured PHI in any form. Business associates must notify the covered entity, or their upstream BA, when they discover a breach of unsecured PHI.

According to Section 164.410, a notification must:

Occur without unreasonable delay, not just before the deadline.
Arrive within 60 calendar days of discovery, unless a permitted law-enforcement delay applies.

A business associate agreement (BAA), or the written contract documenting a covered entity’s required assurances from its BA, may also set a shorter reporting deadline to give the covered entity more time to coordinate its response. Either way, the clock starts at discovery — when the BA knows about the breach or would have known through reasonable diligence.

Notably, Section 164.410 treats knowledge held by the BA’s employees, officers, or other agents as the BA’s own, with the exception of the person who committed the breach.

The notice must give the covered entity enough information to act. That includes:

Affected individuals: Each person whose PHI was involved, identified to the extent possible.
Supporting information: Any details the covered entity needs to prepare its own notices to individuals.
Follow-up details: Information that wasn’t available at first should follow promptly as the BA learns it.

Examples of HIPAA Enforcement for BAs

OCR’s 2026 MMG Fusion settlement is one example of what can happen when a BA fails to meet its HIPAA obligations. After receiving a complaint about an unreported security incident and the posting of PHI on the dark web, OCR opened an investigation into the software company. It found several potential violations, including:

Impermissible disclosure of PHI
Failure to conduct an accurate risk analysis
Failure to notify affected covered entities after the breach

The incident, which occurred in 2020, affected approximately 15 million individuals. MMG agreed to pay $10,000 and follow a three-year corrective action plan.

Our HIPAA risk assessment guide covers the risk analysis requirement behind MMG’s failure in more detail.

OCR’s 2026 Consociate settlement shows what an inaccurate risk analysis can cost a BA. First, the third-party administrator for health plans suffered a phishing attack in July 2020 that gave the attacker access to a server holding ePHI. It then experienced a ransomware attack, reported in late 2021.

The breach affected about 136,539 people, exposing names, Social Security numbers, financial account numbers, and health conditions. After OCR’s investigation found no accurate and thorough risk analysis in place, it issued a $225,000 settlement and placed the company under a two-year corrective action plan.

What HITECH Changed for Business Associates

When the HITECH Act was enacted in 2009, it changed two things for BAs. More specifically:

It applied the HIPAA Security Rule to them directly.
It made them subject to federal enforcement, giving OCR authority to investigate their compliance and impose penalties for the provisions that apply directly to them.

HHS added these changes to the HIPAA Rules through the 2013 HIPAA Omnibus Final Rule, effective March 26, 2013.

The Omnibus Rule also made subcontractors that handle PHI for BAs business associates themselves. That means each BA must manage its downstream PHI-handling agreements, as well as its own safeguards.

Covered entities retain their own duties, including obtaining the required contractual assurances and responding when they know of a pattern of activity or practice that materially breaches or violates a BA’s obligations.

In some cases, a covered entity can also be held liable for its BA’s violations if the BA acts as its agent. The subcontractor section below explains the required response and its conditions.

In December 2024, HHS proposed annual verification of BAs’ technical safeguards in its HIPAA Security Rule Notice of Proposed Rulemaking (NPRM). As of October 2026, HHS still describes these changes as proposed, stating that the current Security Rule remains in effect.

Business Associate Agreement (BAA) Requirements

A business associate agreement (BAA) is a legally binding agreement between a covered entity and its business associate—or a BA and its PHI-handling subcontractor—that specifies how PHI may be used, disclosed, and protected.

The required assurances are generally documented in a written contract. HIPAA also permits other specified arrangements, including a memorandum of understanding (MOU) or qualifying law when both parties are governmental entities.

When drafting or reviewing a BAA, covered entities and BAs should check its terms against two sets of HIPAA requirements. They are:

The Privacy Rule’s contract requirements at 45 CFR § 164.504(e).
The Security Rule’s additional ePHI contract requirements at § 164.314(a).

The table below summarizes the clauses a BAA must include, with additional Security Rule requirements where ePHI is involved.

Required BAA Clause	What It Must Specify	Source Rule(s)	CFR Anchor
Permitted and required uses	Establish the PHI uses and disclosures the agreement permits and requires	Privacy	§ 164.504(e)(2)(i)
Use and disclosure limits	Restrict further use or disclosure to the agreement’s terms and legal requirements	Privacy	§ 164.504(e)(2)(ii)(A)
Safeguards	Require appropriate PHI safeguards and applicable Security Rule compliance for ePHI	Privacy; Security	§ 164.504(e)(2)(ii)(B); § 164.314(a)(2)(i)(A)
Incident and breach reporting	Report impermissible uses or disclosures, breaches of unsecured PHI, and known security incidents	Privacy; Security; Breach Notification	§ 164.504(e)(2)(ii)(C); § 164.314(a)(2)(i)(C); § 164.410
Subcontractor agreements	Require PHI-handling subcontractors to accept the same restrictions, conditions, and applicable Security Rule requirements	Privacy; Security	§ 164.504(e)(2)(ii)(D); § 164.314(a)(2)(i)(B)
Individual access	Make PHI available to satisfy access obligations under § 164.524	Privacy	§ 164.504(e)(2)(ii)(E)
Amendments	Make PHI available for amendment and incorporate amendments under § 164.526	Privacy	§ 164.504(e)(2)(ii)(F)
Accounting of disclosures	Supply information needed for an accounting under § 164.528	Privacy	§ 164.504(e)(2)(ii)(G)
Delegated CE obligations	Apply relevant Privacy Rule requirements when performing a covered entity’s obligation	Privacy	§ 164.504(e)(2)(ii)(H)
HHS compliance review	Make relevant internal practices, books, and records available to HHS	Privacy	§ 164.504(e)(2)(ii)(I)
Return, destruction, and retained PHI	Return or destroy PHI at termination where feasible; otherwise extend protections and restrict further uses and disclosures	Privacy	§ 164.504(e)(2)(ii)(J)
Termination authority	Authorize the CE to terminate for a material contractual violation	Privacy	§ 164.504(e)(2)(iii)

For help with drafting BAAs, HHS offers sample provisions with model wording. The sample covers only HIPAA’s requirements, so legal reviewers should also check relevant state laws for additional terms. Both sides can then add their own terms, such as reporting deadlines, audit rights, data location, and what happens to PHI at termination.

Check the Security Rule requirements behind BAA clauses.

Use the HIPAA Security Rule Crosswalk to connect BA-contract requirements with assessment questions, explanatory guidance, and related controls across frameworks.

Explore BA-Contract Safeguards in the HIPAA Security Rule Crosswalk →

Common HIPAA Business Associate Examples

Cloud providers, billing services, records-management firms, and consultants that handle PHI for covered entities are usually BAs. HHS business associate guidance also lists claims processing, legal services, and IT support as examples of work that may qualify a vendor as a BA when it involves handling PHI on behalf of a CE.

The table below shows common BA services and the PHI-handling activities.

BA Category	Example Service	PHI-Handling Activity
Cloud and hosting	Storage for a clinical application	Maintain ePHI for a CE or another BA
Electronic health record (EHR) services	Hosted EHR or support service	Maintain or access patient records during the contracted service
Billing and claims	Outsourced billing service	Process patient information for claims and collection
Healthcare clearinghouses	Claims conversion for a provider	Process PHI on behalf of another CE; clearinghouses are also CEs
Medical transcription	Contracted transcription service	Convert clinical recordings containing PHI into records
IT support	Remote systems administration	Handle ePHI while supporting the CE’s systems
Cybersecurity services	Investigation involving patient-data logs	Receive or review PHI as part of the contracted security service
Legal services	Outside counsel reviewing patient files	Use PHI for legal work performed for the CE
Accounting services	Audit of claims-related records	Review PHI when providing the contracted financial service
Records storage and disposal	Off-site storage or document destruction	Maintain or dispose of records containing PHI
Medical coding	Outsourced chart coding	Review patient documentation to assign clinical codes
Consulting	Compliance review using patient records	Receive PHI while advising the covered entity

What each vendor actually does and how it handles PHI determine whether it qualifies as a BA and needs a BAA. Cloud providers that retain ePHI, for example, qualify as BAs and need BAAs.

Postal services and couriers, on the other hand, generally don’t need a BAA when they only transport PHI and store it no longer than the delivery requires. The same goes for janitorial services and similar vendors whose work doesn’t involve using or disclosing PHI and whose access to it is incidental, as long as the CE has reasonable safeguards in place.

Subcontractors and Downstream Liability

Under 45 CFR § 160.103, a subcontractor that creates, receives, maintains, or transmits PHI on behalf of a BA is also a BA, meaning it has to meet the applicable HIPAA requirements like any other BA.

In practice, PHI can pass through several hands before it reaches the subcontractor that actually processes it. To keep it protected at every step, HIPAA generally requires a contract or other qualifying arrangement with each immediate downstream PHI-handling partner, under § 164.314 and § 164.504(e)(5).

The example below uses written BAAs to show which organizations obtain assurances from their immediate downstream partners. Each agreement extends applicable safeguards, use and disclosure restrictions, and reporting duties to the next PHI-handling subcontractor.

Tier	Role	Example	Signs a BAA with
1	Covered entity (CE)	A hospital shares patient information for billing	The billing company
2	Business associate (BA)	A billing company processes the hospital’s claims	The hospital and the cloud provider
3	Subcontractor BA	A cloud provider stores the billing company’s ePHI	The billing company and the backup service
4+	Further subcontractor BA	A backup service backs up the ePHI stored by the cloud provider	The cloud provider

Each organization is responsible for its own downstream agreement. The billing company must require the cloud provider to protect PHI and report impermissible uses or disclosures, security incidents, and breaches. The cloud provider, in turn, must require the same of its backup service.

Who Is Liable for a Subcontractor’s HIPAA Violations?

A subcontractor is directly liable for its own HIPAA violations. The company that hired it, whether a covered entity or another BA, can share that liability under the HIPAA Enforcement Rule at § 160.402(c) when the subcontractor acts as its agent and the violations occur within the scope of that agency.

Whether that agency exists depends on the contract terms and how the parties work together in practice, particularly whether the hiring company has the right to control how the subcontractor performs its work. Calling the subcontractor an “independent contractor” won’t by itself protect the hiring company if it directs how the work gets done.

When a CE or BA knows of a pattern of activity or practice that constitutes a material breach or violation of its downstream partner’s BAA, it must take reasonable steps to cure the breach or end the violation under § 164.504(e)(1)(ii)–(iii). If those steps fail, it must terminate the contract or arrangement where feasible.

Following a violation, OCR can:

Investigate a subcontractor for its own HIPAA obligations directly.
Hold an upstream party liable for violations arising from its agent’s acts or omissions within the scope of that agency.
Penalize an upstream party for failing to take the required reasonable steps in response to a known pattern constituting a material breach or violation of its downstream BAA.

How to Manage Business Associate Risk at Scale

Organizations manage BA risk by identifying which vendors handle PHI, documenting the agreements in place, assessing each vendor’s safeguards, and tracking corrective actions when something falls short. As the number of vendors grows, a documented third-party risk management (TPRM) process helps teams apply those activities consistently across every relationship.

The five steps below are a good place to start, and organizations can adapt them to each vendor’s risk, contract terms, and legal requirements. Along the way, teams should also document why each vendor’s review frequency makes sense, based on the PHI it handles, how important it is to operations, and any unresolved security concerns.

Step 1 — Maintain a Current Vendor Inventory

The first step is to identify every organization that handles PHI, its services, and the internal relationship owner.

For each vendor, record its BAA status, data classification, contract-review dates, assessment history, and disclosed PHI-handling subcontractors.
Since BA status applies to PHI in any format, include vendors that handle physical records as well as cloud services.
Then compare procurement records with what service owners report, and flag any relationship that still needs a documented BA-status decision.

Step 2 — Categorize Vendors by Risk

The second step is to categorize vendors by PHI sensitivity and volume, access, and operational importance.

Prioritize the vendors that provide critical services for more detailed assessments–a provider hosting the primary EHR system, for example.
Consider each subcontractor’s incident history and service changes before deciding how detailed an assessment needs to be.
Assess the sensitivity of the records involved rather than treating an infrequently used vendor as low risk.

Step 3 — Standardize the Security Assessment

The third step is to standardize assessment questions so reviewers can compare safeguards, responsibilities, and supporting evidence.

Map HIPAA-specific questions to the administrative, physical, and technical requirements described earlier, and request evidence to support each response.
For cloud services, identify the safeguard documentation or audit access needed to evaluate risk. Then, negotiate contract terms that make that evidence available.
Distinguish these negotiated assurances from HIPAA’s required BAA assurances, as explained in HHS cloud guidance.

The Higher Education Community Vendor Assessment Toolkit (HECVAT) serves college and university vendor-risk reviews, including relevant academic healthcare relationships. Confirm its scope and permitted use before adopting it for a different setting.

Step 4 — Track Findings and Corrective Actions

The fourth step is to record findings in a shared risk register with owners and corrective-action deadlines.

Attach supporting evidence, track progress, and verify that the issue has been addressed before closing the finding.
Include vendor findings in the organization’s broader HIPAA risk assessment so risks involving outsourced systems and services are considered alongside internal risks.
Use the register to support the accurate and thorough analysis of risks to ePHI required by § 164.308(a)(1)(ii)(A).

Step 5 — Set a Risk-Based Review Schedule

The fifth step is to schedule reassessments, contract reviews, and follow-up on unresolved findings according to documented risk.

Consider annual reviews or more frequent checks for high-risk services, when the documented risk assessment supports it.
Account for periodic evaluations and reevaluations in response to relevant environmental or operational changes required by § 164.308(a)(8).
Schedule additional reviews when changes to a vendor’s services, systems, or PHI handling could affect risk.
Track contract-review dates separately from renewal dates, and document why the chosen review frequency is appropriate.

Use the HIPAA security audit guide to identify records and evidence that support a review of safeguards in practice.

How to Simplify HIPAA Business Associates Risk Management

Managing business associate risk means collecting, organizing, and maintaining current records of PHI-handling vendors, their agreements, HIPAA security assessments, and corrective actions. A single, centralized platform makes managing all that information much simpler.

Isora GRC is the GRC Assessment Platform™ that connects vendor inventories, questionnaires, assessments, and risk findings to support that work.

See the GRC Assessment Platform™ in action →

Inventory Management

Record each vendor, classify the information its products handle, and connect its assessments and risks in one inventory. In Isora, customizable metadata and vendor-product deployment records give reviewers the ownership and data context needed for assessment decisions.

Learn more about Inventory Management with Isora GRC →

Questionnaires & Surveys

Select a HIPAA questionnaire, invite contributors, and collect responses with supporting evidence to document each vendor’s safeguards consistently. In Isora, contributors can work on one questionnaire, attach evidence to individual questions, and submit responses for approval.

Learn more about Questionnaires & Surveys with Isora GRC →

Assessment Management

Organize vendor assessments, assign deadlines, and track completion so the team can identify outstanding reviews and coordinate follow-up. In Isora, assessment series group reviews by compliance goal, while live progress metrics show completion and scoring across targets.

Learn more about Assessment Management with Isora GRC →

Risk Management

Review assessment findings, assign risk owners, and track remediation plans so each unresolved vendor issue has documented follow-up. In Isora, the connected risk register preserves questionnaire and control context alongside remediation milestones and status through closure.

Learn more about Risk Management with Isora GRC →

Key Takeaways

Business associate status can arise from maintaining PHI for a covered entity or another BA, including encrypted storage without access to the key. BAs have direct HIPAA obligations, and their agreements must define permitted uses, safeguards, reporting duties, subcontractor obligations, and PHI handling when the relationship ends.

Manage BA risk with a current vendor inventory, consistent security assessments, and documented corrective actions. Set review schedules according to risk, and reassess when services, systems, or PHI handling change.

Isora GRC connects vendor records, assessment evidence, and remediation tracking to help teams coordinate that ongoing work.

See how Isora GRC supports HIPAA Security Rule compliance →

HIPAA Business Associates FAQs

What is a HIPAA business associate?

A HIPAA business associate (BA) performs specified functions or services involving protected health information (PHI) for a covered entity, outside its workforce. Qualifying PHI-handling subcontractors are also BAs. The definition has exceptions, including a provider receiving information to treat a patient.

Do business associates have to comply with the HIPAA Security Rule?

Yes, business associates must comply directly with the Security Rule’s applicable requirements for ePHI. The HITECH Act of 2009 made Security Rule compliance a direct legal duty for BAs, and the 2013 HIPAA Omnibus Rule implemented those changes. As a result, OCR can investigate violations by BAs and impose penalties.

What is a business associate agreement (BAA)?

A business associate agreement (BAA) is usually a legally binding written contract between a covered entity and its business associate—or between a BA and its PHI-handling subcontractor. It defines permitted PHI uses and disclosures, required safeguards, incident reporting, subcontractor obligations, and how PHI must be handled when the agreement ends.

Is a subcontractor of a business associate also a business associate?

A subcontractor qualifies as a BA when it creates, receives, maintains, or transmits PHI for an upstream business associate. HIPAA extends BA status to these subcontractors so PHI remains protected as it passes between vendors. The subcontractor must meet applicable HIPAA requirements. Its upstream BA must obtain the required assurances through a contract or other qualifying arrangement.

What’s the difference between a covered entity and a business associate?

A covered entity (CE) is a health plan, clearinghouse, or provider that transmits health information electronically in covered transactions. A business associate (BA) handles PHI for a CE, and a covered entity can also act as another CE’s BA.

This content is for informational purposes only and does not constitute legal or compliance advice. See our full disclaimer.

Learn More

Our GRC Resources

Dive into our research-backed resources–from product one pagers and whitepapers, to webinars and more–and unlock the transformative potential of powerfully simple GRC.