Business Associate

The definition in 45 CFR 160.103 turns on function, not on what a vendor calls itself. If a person or company, other than your own workforce, creates, receives, maintains, or transmits PHI for a function regulated by HIPAA (claims processing, data analysis, billing, storage, and so on), it is a business associate. That sweeps in the obvious vendors (EHR, clearinghouse, billing service) and some less obvious ones (cloud backup, an AI notetaker, IT support with access to systems that hold PHI).

Being a business associate has consequences on both sides. The covered entity must obtain satisfactory written assurances (a Business Associate Agreement) before the vendor handles PHI, and the business associate is itself directly liable for parts of the Security and Breach Notification Rules. A vendor advertising that it is HIPAA compliant is not a substitute for the signed agreement: the contract is what makes the relationship compliant, and it is the covered entity’s job to have it on file.

Not every outside relationship is a business-associate relationship. A disclosure to another provider for treatment, or to a plan for payment, is generally not a business-associate arrangement. That is why each vendor and partner deserves a quick business-associate-versus-treatment-disclosure analysis rather than a blanket assumption.