HIPAA Compliance for Business Associates

What is a Business Associate under HIPAA? Any company that handles protected health information (PHI) on behalf of a healthcare organization is considered to be a Business Associate bound to comply with HIPAA. In other words, even if your business isn’t a healthcare organization, you may be required to follow HIPAA regulations.

In this blog, we’ll cover the HIPAA responsibilities and CFR-based requirements that business associates need to understand, including the importance of Business Associate Agreements (BAAs) and the risks of being non-compliant.

Covered Entities vs Business Associates

There’s a common misconception that the Health Insurance Portability and Accountability Act (HIPAA) only regulates healthcare organizations, but that can be a dangerous assumption for certain businesses to hold onto. In reality, HIPAA applies to two groups: Covered Entities (CEs), which are healthcare organizations, and Business Associates (BAs), which are not.

Both groups are held responsible under the law for applying certain safeguards to PHI. Business Associates can be penalized directly for HIPAA infractions by the Health and Human Services’ Office of Civil Rights (HHS OCR). In fact, when an incident involves a covered entity and its business associate, both parties may be held liable for their own role.

Core HIPAA Rules Business Associates Must Follow

Do business associates need to follow HIPAA? Absolutely. HIPAA imposes a set of requirements for business associates that we’ll outline below. These are federal mandates, not best practices. They’re not optional, and you can pay dearly if you treat them as such.

HIPAA Privacy Rule (45 CFR Part 164 Subpart E)

The HIPAA Privacy Rule (found under 45 CFR 164 Subpart E) limits the use and disclosure of PHI for covered entities and business associates. Among other things, HIPAA requires that only the “minimum necessary” health information be shared to accomplish an intended purpose.

In addition to being bound by HIPAA regulations, business associates also must comply with the use and disclosure limitations imposed on them by the terms in their Business Associate Agreement (BAA), which we’ll discuss in further detail later.

HIPAA Security Rule (45 CFR Part 164 Subpart C)

The HIPAA Security Rule (found under 45 CFR 164 Subpart C) requires electronic PHI (ePHI) to be protected from unauthorized access.

The Security Rule requires covered entities and business associates to:

• Implement three types of safeguards, including:
  • Administrative (policies and procedures to manage security measures)
  • Physical (control of physical access to systems and facilities)
  • Technical (control and oversight of electronic access to PHI)
• Conduct regular risk analysis for threats
• Implement ongoing risk management

HIPAA Breach Notification Rule (45 CFR §§164.400–414)

The HIPAA Breach Notification Rule (found under 45 CFR 164.400-414) requires business associates to notify covered entities after a breach with known details “without unreasonable delay” and no later than 60 days after discovery.

This rule means the circumstances of the breach may represent their own HIPAA infraction, but failure to report the breach in a timely manner is its own violation.

HIPAA Requirements for Business Associates At a Glance

Compliance can be complicated, but the table below provides an at-a-glance reference for HIPAA CFR Business Associate requirements.

Below, we’ll break down each of these requirements, so you have a preliminary HIPAA compliance checklist.

Business Associate Responsibilities During a Data Breach

Business associates have specific responsibilities in the event of a data breach.

Safeguard Implementation

Under the HIPAA Security Rule and HITECH Act, business associates have proactive security responsibilities to safeguard PHI and prevent data breaches. They must implement administrative, physical, and technical safeguards, conduct periodic risk analysis for security threats, and implement ongoing risk management.

They’re also required to document these compliance activities and maintain records for at least six years to prove they’re meeting their obligations. Required documentation includes:

• A signed BAA with the covered entity
• Subcontractor BAAs, if applicable
• Risk analysis and management plan for identifying and mitigating risks
• Written policies and procedures covering security controls, employee conduct, incident response, and breach notification
• Training records for all employees
• Incident response logs for security incidents, breach risk assessments, and outcomes
• Documentation of periodic audits or reviews to verify that safeguards are operating effectively

A lack of documentation, especially written risk assessments, can cause the OCR to cite the business associate for “willful neglect,” which will trigger mandatory penalties.

Breach Reporting Obligations

When business associates discover a breach of unsecured PHI (like a cybersecurity attack), HIPAA requires them to notify any covered entities “without reasonable delay,” absolutely no later than 60 calendar days after its discovery.

The notification should include:

• The identification of all affected individuals
• All available information needed for the CE to notify victims, regulators, and the media

Subcontractor Oversight

If a business associate engages subcontractors to create, receive, maintain, or transmit PHI on their behalf, they must ensure these subcontractors adhere to the same HIPAA regulations and restrictions as the business associate.

This requires executing a BAA with each subcontractor, extending HIPAA's privacy and security obligations down the vendor chain.

What Is a Business Associate Agreement (BAA)?

A HIPAA Business Associate Agreement (BAA) is a HIPAA contract legally required under 45 CFR 164.502(e) and 164.504(e). It establishes the responsibilities and expectations between a covered entity (such as healthcare providers, health plans, or healthcare clearinghouses) and any business associate that performs functions or activities involving the use or disclosure of PHI. Representatives of both the covered entity and the business associate must sign the BAA to execute it.

The primary purpose of a BAA is to ensure that business associates handle PHI in compliance with HIPAA's privacy and security requirements. Handling PHI on behalf of a covered entity without a BAA is a common HIPAA violation.

Required Elements of a HIPAA BAA

Required elements of a BAA include:

• Permitted Uses and Disclosures: The BAA must explicitly define how the BA can use PHI, limiting it to services provided to the CE or as required by law. It should explicitly prohibit using PHI for purposes like marketing.
• Safeguarding Requirements: The BAA should describe the business associate’s obligations to safeguard PHI with administrative, physical, and technical measures.
• Reporting Obligations: The BAA should mandate prompt reporting of unauthorized PHI use or breaches to the CE.
• Subcontractor Compliance: The BAA should clarify the BA’s obligations to ensure that all subcontractors and agents handling PHI agree to follow the same restrictions, conditions, and safeguards as the BA.
• Termination & PHI Return/Destruction: Upon termination of the contract, the BAA must require the BA to destroy or return all PHI, including what’s held by subcontractors, and provide a certificate of destruction.

Benefits of HIPAA Compliance for Business Associates

For business associates, HIPAA compliance can serve two purposes:

• Protection: Compliance protects your reputation and legal standing against fines.
• Opportunity: HIPAA compliance confers a competitive advantage, providing a tangible asset for winning lucrative contracts with healthcare entities.

Protective benefits of HIPAA compliance include:

• Reduced Legal Risk, helping you avoid massive civil penalties and burdensome investigations.
• Reputation Management. The robust security controls and risk mitigation measures required by HIPAA can help you prevent breaches, leaving your data security reputation pristine.

In terms of business opportunity, the benefits of HIPAA compliance include:

• Improved Security Posture: HIPAA’s data security requirements are some of the most rigorous in existence, so strict compliance ensures excellent security hygiene.
• Stronger Client Trust: Clients recognize the strength of HIPAA’s security rule, so even those outside the healthcare ecosystem will find this qualification attractive as a benchmark for data security.
• Competitive Advantage: A pre-existing robust HIPAA compliance program is a market differentiator that can attract and streamline the contracting phase.
• Operational Consistency: By forcing you to consider and document strict data security protocols, HIPAA compliance ensures that data is treated consistently across all clients, streamlining workflows and improving reliability.

Consequences of HIPAA Violations for Business Associates

HIPAA violations can have many negative consequences, including:

• Civil Penalties: Fines can range from $141 to $2,134,831 per violation, depending on severity.
• OCR Enforcement Actions: Investigations and resulting corrective actions are time-consuming and expensive, and they typically cause operational disruptions.
• Lawsuits: Violations put you at risk of legal action from affected patients, covered entities, state attorneys general, and other regulatory bodies.
• Contract Loss: Covered entities often place stipulations in their BAA that allow for contract termination due to HIPAA violations on the business associates’ part.
• Reputational Damage: HIPAA violations often lead to a loss of public trust and decreased business opportunities.

Here are a few real examples of business associates who paid the price for HIPAA non-compliance:

• In 2018, a medical imaging services company’s misconfigured server made PHI accessible on the internet and failed to report the breach properly; this cost them $3 million in fines.
• In 2025, OCR announced settlements with four different business associates for failing to perform thorough risk analyses; the BAs paid out a collective total of over $3.5 million.
• From 2013-2015, a covered entity incurred a major violation after a security breach at Blackhawk Consulting Group revealed that it had no BAA in place. While the BA wasn’t fined by OCR directly, it dropped off the map afterward, likely going out of business.

Common HIPAA Compliance Challenges for Business Associates

Business associates often discover compliance gaps as a result of an audit or security incident, but here are three common compliance challenges where you can identify hidden risk.

Lack of HIPAA Awareness

Many non-healthcare vendors fail to understand their HIPAA obligations. IT providers, billing firms, consultants, and others may handle PHI without realizing they need to meet the same compliance standards as their healthcare partners.

As a result, they fail to put necessary policies, training, and oversight in place.

Weak Security Controls

Vendors may have general cybersecurity measures in place, but these fail to meet HIPAA’s required administrative and technical safeguard requirements. Common gaps include incomplete risk assessments, flawed access management, unencrypted devices, and weak documentation.

Delayed Breach Notification

When breaches occur, business associates must report them to covered entities quickly. A common source of delay is the desire to complete an internal investigation before escalating, but slow reporting can increase penalties and damage client trust.

Breaches should be reported as soon as possible, even if it means you need to provide additional context and information later.

How to Stay HIPAA Compliant as a Business Associate

Below, we’ll define key sections necessary in a HIPAA compliance checklist for business associates.

Execute Required BAAs

A BAA must be in place before you, as a non-healthcare business associate, receive or handle PHI. We reviewed the required elements of a BAA above.

Establish Administrative Policies

Business associates need written HIPAA policies to address privacy, security, and incident response, including documented risk assessments, workforce procedures, training plans, and governance documents to ensure accountability across the organization.

Implement Technical and Physical Safeguards

HIPAA requires controls to protect information in every format. This includes:

• Role-based access
• Encryption
• Audit logs
• Device security
• Secure storage of records
• Restricted physical access to systems and files

Train Employees on HIPAA Requirements

HIPAA requires all employees to receive some HIPAA training at onboarding, which should be repeated “regularly” afterward. The industry best practice requires refresher training at least annually.

Employees with no intended PHI access must understand the seriousness of doing so unauthorized. Employees who will handle PHI in the course of their duties need role-specific instruction, so they understand how to handle PHI in a HIPAA-compliant manner and respond to security incidents.

HIPAA Training for Business Associates

Due to the unique challenges of non-healthcare vendors, targeted HIPAA training for business associates is recommended over general HIPAA training. BA-tailored HIPAA training emphasizes the applicability of HIPAA to non-healthcare vendors and their employees and provides PHI handlers with the context and knowledge they need for compliance.

Our HIPAA Training For Business Associates is role-specific, online, and self-paced, which makes it a scalable and simple solution for vendors stepping into HIPAA-compliant territory. Enroll today!