Business Associate
What is Business Associate?
Under HIPAA, a person or entity that performs certain functions or activities involving the use or disclosure of Protected Health Information on behalf of a covered entity. Business associates must comply with HIPAA Security and Breach Notification Rules.
Terms that appear alongside business associate
Each of these is named in at least one of the same controls as business associate. The number is how many controls name both.
- covered entity 12 shared controls
- hipaa 12 shared controls
- breach notification 9 shared controls
- nist 7 shared controls
- hipaa security rule 7 shared controls
- compliance 6 shared controls
- audit 5 shared controls
- encryption 5 shared controls
Frameworks that govern business associate
What the standards actually require on business associate
Requirements naming business associate across 6 standards, quoted from the control text.
Where a fraud event involves a business associate, respond within the organization's contractual rights and the associate's commitments (8.2.8): investigate with the associate's cooperation, suspend or end the relationship where warranted, recover losses, revi...
iso-37003-2025::8.4.14 · Responding to fraud events involving business associates →Require, through procedures, that every organization under the organization's control either runs the organization's anti-bribery system or operates anti-bribery controls of its own, either way so far as reasonable and proportionate given the bribery risks it...
iso-37001-2016::8.5 · 8.5 Implementation of anti-bribery controls by controlled organizations and by business associates →In light of the bribery risks identified (4.5), the organization puts in place procedures for anti-bribery training of those business associates who act for it or to its advantage and who may present a bribery risk above low.
iso-37001-2025::7.3.3 · 7.3.3 Training for business associates →The Secretary provides for periodic audits to ensure that covered entities and business associates comply with the subtitle and with the Privacy and Security Rules;
hitech-act::13411 · Section 13411: periodic HHS audits of covered entities and business associates →The contract or other arrangement required by 164.308(b)(3) must meet the requirements of paragraph (a)(2)(i), (a)(2)(ii), or (a)(2)(iii) of this section, as applicable.
164.314(a)(1) · Business Associate Contracts or Other Arrangements (Standard) →A business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 days after discovery, identifying to the extent possible each individual whose unsecured PHI was breached and providing the information the covered...
hipaa-breach-notification-rule::164.410 · Business associate notification to the covered entity →Questions people ask about business associate
What is Business Associate?
Why is Business Associate important for compliance?
Which compliance frameworks address Business Associate?
Where can I learn more about Business Associate?
See how Business Associate applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.