Business Associate
What is Business Associate?
Under HIPAA, a person or entity that performs certain functions or activities involving the use or disclosure of Protected Health Information on behalf of a covered entity. Business associates must comply with HIPAA Security and Breach Notification Rules.
Terms that appear alongside business associate
Each of these is named in at least one of the same controls as business associate. The number is how many controls name both.
- covered entity 12 shared controls
- hipaa 12 shared controls
- breach notification 9 shared controls
- nist 7 shared controls
- hipaa security rule 7 shared controls
- compliance 6 shared controls
- audit 5 shared controls
- encryption 5 shared controls
Frameworks that govern business associate
What the standards actually require on business associate
Requirements naming business associate across 6 standards, quoted from the control text.
The contract or other arrangement required by 164.308(b)(3) must meet the requirements of paragraph (a)(2)(i), (a)(2)(ii), or (a)(2)(iii) of this section, as applicable.
164.314(a)(1) · Business Associate Contracts or Other Arrangements (Standard) →HITECH Subtitle D - Breach Notification + Business Associate (BA) direct liability. BREACH NOTIFICATION RULE (Section 17932; 45 CFR Part 164 Subpart D, Sections 164.400-414): covered entities + BAs must provide notification following discovery of a breach of U...
HITECH-SubtitleD-Breach-Notification-BA-Direct-Liability · HITECH Subtitle D - Breach Notification Rule (45 CFR Part 164 Subpart D), Business Associate Direct Liability, Subcontractors →Manage Business Associate relationships per HIPAA Security Rule 45 CFR 164.308(b) and HIPAA Privacy Rule 45 CFR 164.502(e). Obtain satisfactory assurances per a written contract or other arrangement (a Business Associate Agreement - BAA) that the business asso...
NISTSP66-4 · Business Associate Agreements (BAAs) and Third-Party ePHI Governance →A covered entity may permit a business associate to handle ePHI only after obtaining satisfactory assurances via written contract. NIST recommends due diligence, security questionnaires, and ongoing monitoring of BAs.
164.308(b)(1) · Business Associate Contracts and Other Arrangements (Standard) →Business associate management. Control from ISO 27799 framework, domain: ISO 27799: Administrative Safeguards.
ISO27799-11 · Business associate management →16 CFR 318.1 purpose + scope. APPLICABILITY: applies to (1) VENDORS OF PERSONAL HEALTH RECORDS (PHR) - entities offering PHR product or service to consumers + that obtain consumer health information from other sources (e.g. cross-source aggregation);
HBNR-Scope-PHR-Vendor · Scope, PHR Vendor and PHR-Related Entity Applicability (16 CFR 318.1) →Questions people ask about business associate
What is Business Associate?
Why is Business Associate important for compliance?
Which compliance frameworks address Business Associate?
Where can I learn more about Business Associate?
See how Business Associate applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.