What is a business associate?

The definition, in plain words

HIPAA's definition, found in 45 CFR 160.103, has two parts. First, a business associate is someone who, on behalf of a covered entity, creates, receives, maintains or transmits protected health information for a function or activity the HIPAA rules regulate, such as claims processing, data analysis, utilization review, billing or practice management. Second, it is someone who provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial services to the covered entity, where the service involves disclosing PHI.

Strip away the legal phrasing and the test is simple. Ask three things about any outside party:

1. Is it outside my workforce? Employees, volunteers and trainees under your direct control are workforce members, not business associates.
2. Does it touch PHI? Names, phone numbers, appointment dates and anything else that identifies a patient in connection with care all count.
3. Is it doing that for my practice? If the party handles the information to perform a service you hired it for, the answer is yes.

Who usually counts, and who usually doesn't

Most of the vendors an independent practice uses today fall on the business associate side of the line, because modern software stores or moves patient data as part of its job.

• Usually business associates: billing and coding services, cloud EHR and practice management vendors, appointment reminder and texting platforms, answering services, IT support firms with access to your systems, cloud backup and storage providers, transcription services, collections agencies, outside auditors who review charts, and revenue recovery tools that work from your schedule.
• Usually not business associates: your employees; another provider receiving PHI for treatment, such as a specialist you refer to; a janitorial service that has no reason to see records; and banks processing ordinary payments, which HIPAA's statute addresses separately.
• The conduit exception: HHS has said that entities that only transport information, such as the postal service or an internet service provider, and that have only random or infrequent access to it, are not business associates. The exception is narrow. HHS guidance on cloud computing says a cloud provider that stores electronic PHI is a business associate even if the data is encrypted and the provider holds no key.

Subcontractors are business associates too

Since the 2013 HIPAA Omnibus Rule, the definition reaches down the chain. If your texting vendor uses a cloud host to store message logs, that host is a subcontractor that creates, receives, maintains or transmits PHI on behalf of a business associate. It is a business associate in its own right.

You do not sign a contract with the subcontractor. Your vendor does. HIPAA requires each business associate to obtain satisfactory written assurances from its subcontractors, which in practice means a subcontractor BAA. When you evaluate a vendor, ask who its subcontractors are and whether those agreements exist. A vendor that cannot answer is telling you something about how it handles your patients' data.

Why the label matters

Calling a vendor a business associate triggers two sets of obligations.

For your practice: before you share PHI with a business associate, you need a written Business Associate Agreement (BAA) that limits how the vendor may use and disclose the data, requires safeguards and requires breach reporting back to you. Our guide to what a Business Associate Agreement must contain walks through the required clauses. Sharing PHI without one is a violation by the practice, even if the vendor never misuses anything.

For the vendor: under the HITECH Act and the Omnibus Rule, business associates are directly liable for certain violations. In a 2019 fact sheet, the HHS Office for Civil Rights listed them, including impermissible uses and disclosures of PHI, failure to comply with the Security Rule, failure to notify the covered entity of a breach, failure to limit PHI to the minimum necessary, and failure to enter BAAs with subcontractors.

Common mistakes practices make

• Assuming "we don't send them charts" means no PHI. A schedule with patient names, phone numbers and appointment times is PHI. So is a list of patients due for a recall visit.
• Signing up first, asking for the BAA later. The agreement must be in place before data moves, including trial accounts and free assessments.
• Treating encryption as an exemption. Encryption lowers risk. It does not turn a storage vendor into a conduit.
• Forgetting low-profile vendors. The IT contractor with remote access, the shredding company and the consultant reviewing your billing all deserve a second look.
• Not keeping a list. Every practice should be able to produce, on request, a list of its business associates and the date each BAA was signed.

A five-minute vendor check

Run this quick check whenever someone proposes a new tool. Write down the vendor name, what it does, which patient data it will see, where that data will be stored and whether a BAA is signed. If the answer to "which patient data" is anything other than "none," you have a business associate. Our longer guide on whether a vendor needs a BAA covers the tricky cases in more depth.

A vendor that hesitates to sign, says HIPAA does not apply to it, or offers a BAA only on a higher pricing tier is a vendor to reconsider. The agreement costs a responsible vendor nothing, and it is the foundation of every patient-data relationship your practice has.