A business associate is any organisation that handles protected health information on behalf of a covered entity. Most health software companies are one.
The short answer
A business associate is a person or organisation that creates, receives, maintains or transmits PHI to perform a function or service for a covered entity. Cloud hosting, billing, analytics, transcription and practice management software all qualify. Since the 2013 Omnibus Rule, business associates are directly liable for Security Rule compliance and can be penalised by regulators without the covered entity being involved.
The status is determined by what you do with the data, not by what your contract calls you. Signing nothing does not keep you outside the definition.
On this page
Who counts as one
| Service | Business associate? |
|---|---|
| Cloud infrastructure storing patient records | Yes, storage alone is enough |
| SaaS platform used by a clinic to manage appointments | Yes |
| Medical billing and coding service | Yes |
| Error monitoring or analytics receiving identifiers | Yes, if PHI reaches it |
| Law firm or accountant reviewing records | Yes, when PHI is involved |
| Office cleaning contractor with no data access | No, incidental physical presence is not handling |
| Another provider treating the same patient | No, that is a permitted treatment disclosure |
Direct liability
The conduit exception
Narrower than most people assume
The exception covers organisations that merely transport data without accessing it other than randomly or infrequently, such as a postal service or a telecoms carrier. Persistent storage takes you outside it. A cloud provider holding encrypted PHI is a business associate even without the decryption key.
What you have to do
Sign BAAs both ways
One with each covered entity customer, and one with every subcontractor that touches PHI.
Meet the Security Rule in full
Administrative, physical and technical safeguards, plus a documented risk analysis.
Report breaches upward
Notify the covered entity without unreasonable delay, within the window your BAA sets.
Parts of the Privacy Rule also reach you, mainly the limits in your BAA on how PHI may be used and the minimum necessary standard. You do not owe patients a privacy notice, but you must support the covered entity in honouring their rights.
How Osto helps business associates
For a health SaaS company the Security Rule is a product requirement, and buyers test it before they sign. Osto deploys the controls, access management and MFA, encryption, audit logging, cloud posture, endpoint control and VAPT, and answers inbound security questionnaires from the same evidence. HIPAA sits beside SOC 2 and ISO 27001 in the same mapping, so one set of controls serves all three.
Free security assessment
Pass the security review before the deal stalls
Osto runs the controls health customers ask about and answers inbound security questionnaires from the same evidence.
Get a free security assessment Book a platform walkthroughDirect liability covered · AI questionnaires · One platform, everything
Frequently asked questions
What is a business associate under HIPAA?
An organisation that creates, receives, maintains or transmits protected health information to perform a service for a covered entity. Cloud hosting, billing, analytics and health software vendors typically qualify.
Is a SaaS company a business associate?
If its product handles PHI for a covered entity customer, yes. That triggers a BAA with each customer, full Security Rule obligations, and direct liability to regulators.
Can a business associate be fined directly?
Yes. Since the 2013 Omnibus Rule, HHS can take enforcement action against a business associate directly for Security Rule violations and for certain Privacy Rule provisions, without proceeding through the covered entity.
What is the conduit exception?
A narrow carve-out for organisations that only transmit data without storing it, such as postal services or telecoms carriers. Any persistent storage of PHI takes a vendor outside the exception.
Do business associates need their own subcontractor BAAs?
Yes. Any subcontractor that handles PHI must sign a BAA with the business associate, on terms at least as protective as the upstream agreement.