Business associate
A person or company that creates, receives, maintains, or transmits protected health information to perform a function for a covered entity — such as billing, claims processing, or collections — and is directly bound by parts of the HIPAA rules.
Updated
A business associate is an outside person or organization that handles protected health information to perform a service on behalf of a covered entity. In the revenue cycle the common examples are a third-party billing company, a collections agency, and a software or data-storage vendor whose systems hold PHI.
A covered entity may let a business associate create, receive, maintain, or transmit PHI on its behalf only after it has a written contract — a business associate agreement — obligating the business associate to safeguard the information and use it only as the contract and the rules permit.
In practice
The role is defined at 45 CFR 160.103, and the written-contract requirement is at 45 CFR 164.502(e) and 164.504(e). Business associates are directly liable for parts of the HIPAA rules, not bound by contract alone, and a business associate's own subcontractors that handle PHI are themselves business associates.
Commonly confused with
- Covered entity: The covered entity is the provider, plan, or clearinghouse; the business associate acts on its behalf.
- Business associate agreement (BAA): The business associate is the party; the BAA is the written contract that must be in place before PHI is disclosed to it.