thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Business Associate

Person or organization that performs functions involving PHI on behalf of a HIPAA covered entity.

Definition

Business associates include billing companies, cloud providers storing PHI, IT support with PHI access, and law firms. Since HITECH and the 2013 Omnibus Rule, business associates are directly liable for Security Rule compliance and certain Privacy Rule requirements. Subcontractors of business associates are also business associates.

Example

A cloud backup provider storing a hospital's ePHI, even encrypted, is a business associate.

Exam tip

A cloud provider storing encrypted PHI without the key is still a business associate per HHS guidance.

Related terms