{"id":835,"date":"2026-08-17T04:57:52","date_gmt":"2026-08-17T04:57:52","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=835"},"modified":"2026-08-17T04:57:52","modified_gmt":"2026-08-17T04:57:52","slug":"business-associate","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/glossary\/business-associate\/","title":{"rendered":"Business Associate: Direct HIPAA Liability"},"content":{"rendered":"\n<!-- =========================================================================\n     OSTO GLOSSARY: BUSINESS ASSOCIATE\n     Shared glossary design system. Paste into one Custom HTML block. No H1.\n     ========================================================================= -->\n\n<style>\n.og{\n  --navy:#1c267a; --text:#0f1538; --muted:#0f1538; --light:#0f1538;\n  --border:#e7e9f2; --divider:#eceef5; --white:#ffffff;\n\n  --peri-50:#f4f5fd;  --peri-100:#e9ecfa; --peri-200:#cfd5f2; --peri-700:#4a52a8;\n  --sage-50:#f2f8f5;  --sage-100:#e3f0e9; --sage-200:#c3ddce; --sage-700:#3a6f5d;\n  --apri-50:#fdf6f0;  --apri-100:#fbe9dc; --apri-200:#f2cdb2; --apri-700:#a2603a;\n  --plum-50:#f8f3f9;  --plum-100:#f0e6f3; --plum-200:#dcc6e2; --plum-700:#6b4576;\n  --sky-50:#f1f7fb;   --sky-100:#e2eff7;  --sky-200:#bfd9e9;  --sky-700:#2f6a89;\n\n  --shadow:0 6px 22px rgba(15,21,56,.05);\n  --font:'Inter',-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;\n  font-family:var(--font); font-size:17px; line-height:1.75; color:var(--text);\n}\n.og p{margin:0 0 22px}\n.og h2{font-family:var(--font);font-size:clamp(25px,3vw,31px);font-weight:700;line-height:1.25;letter-spacing:-.5px;color:var(--navy);margin:52px 0 8px;scroll-margin-top:92px}\n.og h2::after{content:\"\";display:block;width:46px;height:5px;border-radius:3px;margin:12px 0 18px;background:var(--peri-200)}\n.og h2.c-sage::after{background:var(--sage-200)}\n.og h2.c-apri::after{background:var(--apri-200)}\n.og h2.c-plum::after{background:var(--plum-200)}\n.og h2.c-sky::after{background:var(--sky-200)}\n.og ul,.og ol{padding-left:22px;margin:0 0 24px}\n.og li{margin-bottom:9px}\n.og strong{font-weight:600}\n\n.og .dek{font-size:20px;line-height:1.6;color:var(--muted);margin:0 0 18px}\n.og .tags{margin:0 0 30px;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:8px}\n.og .tags li{margin:0}\n.og .tag{display:inline-block;font-size:12px;font-weight:600;letter-spacing:.7px;text-transform:uppercase;padding:6px 13px;border-radius:20px}\n.og .t-peri{background:var(--peri-100);color:var(--peri-700)}\n.og .t-sage{background:var(--sage-100);color:var(--sage-700)}\n\n.og .short{background:linear-gradient(135deg,var(--peri-100) 0%,var(--sage-100) 100%);border-radius:22px;padding:28px 32px;margin:0 0 30px}\n.og .short .k{font-size:13px;font-weight:700;letter-spacing:1.4px;text-transform:uppercase;color:var(--peri-700);margin:0 0 10px}\n.og .short p{font-size:19px;line-height:1.65;margin:0;color:var(--text)}\n\n.og .toc{background:var(--peri-50);border-radius:20px;padding:24px 28px;margin:0 0 34px}\n.og .toc .k{font-size:12px;font-weight:700;letter-spacing:1.3px;text-transform:uppercase;color:var(--peri-700);margin:0 0 12px}\n.og .toc ol{margin:0;padding-left:20px;columns:2;column-gap:34px}\n.og .toc li{margin-bottom:8px;break-inside:avoid;font-size:16px}\n.og .toc a{color:var(--navy);text-decoration:none;border-bottom:1px solid rgba(28,38,122,.22)}\n\n.og .callout{border-radius:4px;padding:24px 28px;margin:0 0 30px;background:var(--white);border:2px solid var(--navy)}\n.og .callout .k{font-weight:700;font-size:17px;margin:0 0 8px;color:var(--navy)}\n.og .callout p:last-child{margin-bottom:0}\n.og .callout.c-plum{background:var(--plum-50);border:none;border-radius:20px}\n.og .callout.c-plum .k{color:var(--plum-700)}\n\n.og figure{margin:0 0 30px}\n.og .sx{overflow-x:auto;-webkit-overflow-scrolling:touch;border-radius:20px;background:var(--white);box-shadow:var(--shadow)}\n.og .sx svg{display:block;width:100%;height:auto;min-width:600px}\n.og figcaption{font-size:14px;line-height:1.6;color:var(--muted);margin-top:12px}\n.og .swipe{display:none}\n\n.og table{width:100%;border-collapse:collapse;margin:0 0 28px;font-size:15px;background:var(--white);border-radius:18px;overflow:hidden;box-shadow:var(--shadow)}\n.og th{text-align:left;padding:14px 16px;font-weight:700;font-size:12.5px;letter-spacing:.8px;text-transform:uppercase}\n.og td{border-bottom:1px solid var(--divider);padding:13px 16px;vertical-align:top;line-height:1.6}\n.og tr:last-child td{border-bottom:none}\n.og .h-peri th{background:var(--peri-100);color:var(--peri-700)}\n.og .h-sage th{background:var(--sage-100);color:var(--sage-700)}\n.og .h-plum th{background:var(--plum-100);color:var(--plum-700)}\n\n.og .trio{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:0 0 28px}\n.og .tcard{border-radius:18px;padding:20px 22px}\n.og .tcard .n{font-size:16px;font-weight:700;margin:0 0 4px}\n.og .tcard .g{font-size:13px;font-weight:600;margin:0 0 10px;opacity:.8}\n.og .tcard p{font-size:14px;line-height:1.55;margin:0;color:var(--muted)}\n.og .tcard.a{background:var(--sky-50)}   .og .tcard.a .n,.og .tcard.a .g{color:var(--sky-700)}\n.og .tcard.b{background:var(--sage-50)}  .og .tcard.b .n,.og .tcard.b .g{color:var(--sage-700)}\n.og .tcard.c{background:var(--plum-50)}  .og .tcard.c .n,.og .tcard.c .g{color:var(--plum-700)}\n\n.og .pill{display:inline-block;font-size:11px;font-weight:700;letter-spacing:.8px;text-transform:uppercase;padding:5px 11px;border-radius:20px;white-space:nowrap}\n.og .p-req{background:var(--plum-200);color:#4d2f57}\n.og .p-exp{background:var(--sky-100);color:var(--sky-700)}\n.og .p-imp{background:#eef0f4;color:var(--muted)}\n.og .p-ask{background:var(--apri-100);color:var(--apri-700)}\n\n.og details{background:var(--white);border-radius:14px;margin:0 0 10px;box-shadow:0 2px 10px rgba(15,21,56,.04)}\n.og summary{cursor:pointer;padding:16px 20px;font-weight:600;font-size:17px;color:var(--navy);list-style:none;display:flex;justify-content:space-between;gap:16px;align-items:flex-start}\n.og summary::-webkit-details-marker{display:none}\n.og summary::after{content:\"+\";font-size:22px;line-height:1;color:var(--peri-700);flex:0 0 auto}\n.og details[open] summary::after{content:\"\\2013\"}\n.og details p{padding:0 20px 18px;margin:0;font-size:16px;line-height:1.7}\n\n.og .related{font-size:15px;color:var(--muted);border-top:1px solid var(--divider);padding-top:22px;margin-top:40px}\n\n@media(max-width:700px){\n  .og{font-size:16px}\n  .og .dek{font-size:18px}\n  .og .short p{font-size:17px}\n  .og .short,.og .toc,.og .callout{padding:22px 20px}\n  .og .toc ol{columns:1}\n  .og .trio{grid-template-columns:1fr}\n  .og .swipe{display:inline;font-weight:600;color:var(--peri-700)}\n  .og table{font-size:14px}\n  .og th,.og td{padding:11px 12px}\n}\n<\/style>\n\n<div class=\"og\">\n\n<p class=\"dek\">A business associate is any organisation that handles protected health information on behalf of a covered entity. Most health software companies are one.<\/p>\n\n<ul class=\"tags\">\n  <li><span class=\"tag t-peri\">Glossary<\/span><\/li>\n  <li><span class=\"tag t-sage\">HIPAA<\/span><\/li>\n<\/ul>\n\n<div class=\"short\">\n  <p class=\"k\">The short answer<\/p>\n  <p>A business associate is a person or organisation that creates, receives, maintains or transmits PHI to perform a function or service for a covered entity. Cloud hosting, billing, analytics, transcription and practice management software all qualify. Since the 2013 Omnibus Rule, business associates are directly liable for Security Rule compliance and can be penalised by regulators without the covered entity being involved.<\/p>\n<\/div>\n\n<p>The status is determined by what you do with the data, not by what your contract calls you. Signing nothing does not keep you outside the definition.<\/p>\n\n<div class=\"toc\">\n  <p class=\"k\">On this page<\/p>\n  <ol>\n    <li><a href=\"#who\">Who counts as one<\/a><\/li>\n    <li><a href=\"#liability\">Direct liability<\/a><\/li>\n    <li><a href=\"#conduit\">The conduit exception<\/a><\/li>\n    <li><a href=\"#obligations\">What you have to do<\/a><\/li>\n    <li><a href=\"#osto\">How Osto helps business associates<\/a><\/li>\n    <li><a href=\"#faq\">FAQ<\/a><\/li>\n  <\/ol>\n<\/div>\n\n<h2 id=\"who\">Who counts as one<\/h2>\n\n<table class=\"h-sage\">\n  <thead>\n    <tr><th>Service<\/th><th>Business associate?<\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td>Cloud infrastructure storing patient records<\/td><td>Yes, storage alone is enough<\/td><\/tr>\n    <tr><td>SaaS platform used by a clinic to manage appointments<\/td><td>Yes<\/td><\/tr>\n    <tr><td>Medical billing and coding service<\/td><td>Yes<\/td><\/tr>\n    <tr><td>Error monitoring or analytics receiving identifiers<\/td><td>Yes, if PHI reaches it<\/td><\/tr>\n    <tr><td>Law firm or accountant reviewing records<\/td><td>Yes, when PHI is involved<\/td><\/tr>\n    <tr><td>Office cleaning contractor with no data access<\/td><td>No, incidental physical presence is not handling<\/td><\/tr>\n    <tr><td>Another provider treating the same patient<\/td><td>No, that is a permitted treatment disclosure<\/td><\/tr>\n  <\/tbody>\n<\/table>\n\n<h2 id=\"liability\" class=\"c-sage\">Direct liability<\/h2>\n\n<figure>\n<div class=\"sx\">\n<svg viewBox=\"0 0 760 230\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" aria-label=\"Regulators can act against a covered entity, a business associate, or a subcontractor directly.\">\n  <defs><marker id=\"baA\" markerWidth=\"9\" markerHeight=\"9\" refX=\"7\" refY=\"4.5\" orient=\"auto\"><path d=\"M0,0 L9,4.5 L0,9 z\" fill=\"#4a52a8\"\/><\/marker>\n  <marker id=\"baR\" markerWidth=\"9\" markerHeight=\"9\" refX=\"7\" refY=\"4.5\" orient=\"auto\"><path d=\"M0,0 L9,4.5 L0,9 z\" fill=\"#a2603a\"\/><\/marker><\/defs>\n\n  <rect x=\"16\" y=\"46\" width=\"150\" height=\"58\" rx=\"13\" fill=\"#1c267a\"\/>\n  <text x=\"91\" y=\"72\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12.5\" font-weight=\"700\" fill=\"#ffffff\">Covered entity<\/text>\n  <text x=\"91\" y=\"91\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"10.5\" fill=\"#b9c1e6\">Clinic, plan, hospital<\/text>\n\n  <line x1=\"172\" y1=\"75\" x2=\"212\" y2=\"75\" stroke=\"#4a52a8\" stroke-width=\"2.5\" marker-end=\"url(#baA)\"\/>\n  <text x=\"192\" y=\"64\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"9.5\" fill=\"#4a52a8\">BAA<\/text>\n\n  <rect x=\"218\" y=\"46\" width=\"150\" height=\"58\" rx=\"13\" fill=\"#e3f0e9\"\/>\n  <text x=\"293\" y=\"72\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12.5\" font-weight=\"700\" fill=\"#3a6f5d\">Business associate<\/text>\n  <text x=\"293\" y=\"91\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"10.5\" fill=\"#0f1538\">Your SaaS platform<\/text>\n\n  <line x1=\"374\" y1=\"75\" x2=\"414\" y2=\"75\" stroke=\"#4a52a8\" stroke-width=\"2.5\" marker-end=\"url(#baA)\"\/>\n  <text x=\"394\" y=\"64\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"9.5\" fill=\"#4a52a8\">BAA<\/text>\n\n  <rect x=\"420\" y=\"46\" width=\"150\" height=\"58\" rx=\"13\" fill=\"#e9ecfa\"\/>\n  <text x=\"495\" y=\"72\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12.5\" font-weight=\"700\" fill=\"#4a52a8\">Subcontractor<\/text>\n  <text x=\"495\" y=\"91\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"10.5\" fill=\"#0f1538\">Your cloud provider<\/text>\n\n  <rect x=\"596\" y=\"40\" width=\"152\" height=\"70\" rx=\"13\" fill=\"#fbe9dc\"\/>\n  <text x=\"672\" y=\"66\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12.5\" font-weight=\"700\" fill=\"#a2603a\">HHS OCR<\/text>\n  <text x=\"672\" y=\"86\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"10.5\" fill=\"#0f1538\">The regulator<\/text>\n  <text x=\"672\" y=\"101\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"10.5\" fill=\"#0f1538\">and enforcer<\/text>\n\n  <path d=\"M672,116 L672,160 L91,160 L91,112\" fill=\"none\" stroke=\"#a2603a\" stroke-width=\"2\" stroke-dasharray=\"5,4\" marker-end=\"url(#baR)\"\/>\n  <path d=\"M660,116 L660,144 L293,144 L293,112\" fill=\"none\" stroke=\"#a2603a\" stroke-width=\"2\" stroke-dasharray=\"5,4\" marker-end=\"url(#baR)\"\/>\n  <path d=\"M648,116 L648,130 L495,130 L495,112\" fill=\"none\" stroke=\"#a2603a\" stroke-width=\"2\" stroke-dasharray=\"5,4\" marker-end=\"url(#baR)\"\/>\n\n  <text x=\"380\" y=\"196\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"12\" font-weight=\"700\" fill=\"#a2603a\">Enforcement can land on any link in the chain, independently.<\/text>\n  <text x=\"380\" y=\"216\" text-anchor=\"middle\" font-family=\"Inter,sans-serif\" font-size=\"11.5\" fill=\"#0f1538\">Since the 2013 Omnibus Rule, being a vendor is no longer a shield.<\/text>\n<\/svg>\n<\/div>\n<figcaption><span class=\"swipe\">Swipe to see the full diagram. <\/span>Solid lines are contracts. Dashed lines are enforcement reach.<\/figcaption>\n<\/figure>\n\n<h2 id=\"conduit\" class=\"c-apri\">The conduit exception<\/h2>\n\n<div class=\"callout\">\n  <p class=\"k\">Narrower than most people assume<\/p>\n  <p>The exception covers organisations that merely transport data without accessing it other than randomly or infrequently, such as a postal service or a telecoms carrier. Persistent storage takes you outside it. A cloud provider holding encrypted PHI is a business associate even without the decryption key.<\/p>\n<\/div>\n\n<h2 id=\"obligations\" class=\"c-plum\">What you have to do<\/h2>\n\n<div class=\"trio\">\n  <div class=\"tcard a\">\n    <p class=\"n\">Sign BAAs both ways<\/p>\n    <p>One with each covered entity customer, and one with every subcontractor that touches PHI.<\/p>\n  <\/div>\n  <div class=\"tcard b\">\n    <p class=\"n\">Meet the Security Rule in full<\/p>\n    <p><a href=\"https:\/\/www.osto.one\/resources\/glossary\/administrative-safeguards\/\">Administrative<\/a>, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/physical-safeguards\/\">physical<\/a> and <a href=\"https:\/\/www.osto.one\/resources\/glossary\/technical-safeguards\/\">technical safeguards<\/a>, plus a documented risk analysis.<\/p>\n  <\/div>\n  <div class=\"tcard c\">\n    <p class=\"n\">Report breaches upward<\/p>\n    <p>Notify the covered entity without unreasonable delay, within the window your BAA sets.<\/p>\n  <\/div>\n<\/div>\n\n<p>Parts of the Privacy Rule also reach you, mainly the limits in your BAA on how PHI may be used and the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/minimum-necessary-standard\/\">minimum necessary standard<\/a>. You do not owe patients a privacy notice, but you must support the covered entity in honouring their rights.<\/p>\n\n<h2 id=\"osto\">How Osto helps business associates<\/h2>\n\n<p>For a health SaaS company the Security Rule is a product requirement, and buyers test it before they sign. Osto deploys the controls, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/mfa\/\">access management and MFA<\/a>, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/encryption-at-rest-and-in-transit\/\">encryption<\/a>, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/siem\/\">audit logging<\/a>, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/cspm\/\">cloud posture<\/a>, endpoint control and <a href=\"https:\/\/www.osto.one\/resources\/glossary\/vapt\/\">VAPT<\/a>, and answers inbound security questionnaires from the same evidence. HIPAA sits beside <a href=\"https:\/\/www.osto.one\/resources\/glossary\/soc-2\/\">SOC 2<\/a> and <a href=\"https:\/\/www.osto.one\/resources\/glossary\/iso-27001\/\">ISO 27001<\/a> in the same mapping, so one set of controls serves all three.<\/p>\n\n<!-- ============ CTA ============ -->\n<div style=\"background:linear-gradient(135deg,#1c267a 0%,#3f4796 48%,#6b4576 100%);border-radius:22px;padding:38px 34px;margin:40px 0 12px;box-shadow:0 10px 26px rgba(28,38,122,.2);text-align:center;\">\n  <p style=\"display:inline-block;background:rgba(255,255,255,.16);color:#ffffff;font-family:'Inter',-apple-system,sans-serif;font-size:11px;font-weight:700;letter-spacing:1.2px;text-transform:uppercase;padding:6px 14px;border-radius:20px;margin:0 0 16px;\">Free security assessment<\/p>\n  <p style=\"color:#ffffff;font-family:'Inter',-apple-system,sans-serif;font-size:26px;line-height:1.3;font-weight:700;letter-spacing:-.4px;margin:0 0 12px;\">Pass the security review before the deal stalls<\/p>\n  <p style=\"color:#cfd3ea;font-family:'Inter',-apple-system,sans-serif;font-size:16px;line-height:1.65;margin:0 auto 26px;max-width:520px;\">Osto runs the controls health customers ask about and answers inbound security questionnaires from the same evidence.<\/p>\n  <a href=\"https:\/\/osto.one\/contact\/\" style=\"display:inline-block;background:#ffffff;color:#1c267a;font-family:&#039;Inter&#039;,-apple-system,sans-serif;font-weight:700;font-size:16px;text-decoration:none;border-bottom:none;padding:14px 30px;border-radius:12px;margin:0 6px 10px;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#1c267a;\">Get a free security assessment<\/span><\/a>\n  <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:transparent;color:#ffffff;font-family:&#039;Inter&#039;,-apple-system,sans-serif;font-weight:600;font-size:16px;text-decoration:none;border:1.5px solid rgba(255,255,255,.5);border-radius:12px;padding:13px 28px;margin:0 6px 10px;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a platform walkthrough<\/span><\/a>\n  <p style=\"color:#b3b8d8;font-family:'Inter',-apple-system,sans-serif;font-size:13px;margin:14px 0 0;\">Direct liability covered &middot; AI questionnaires &middot; One platform, everything<\/p>\n<\/div>\n\n\n<h2 id=\"faq\">Frequently asked questions<\/h2>\n\n<details>\n  <summary>What is a business associate under HIPAA?<\/summary>\n  <p>An organisation that creates, receives, maintains or transmits protected health information to perform a service for a covered entity. Cloud hosting, billing, analytics and health software vendors typically qualify.<\/p>\n<\/details>\n\n<details>\n  <summary>Is a SaaS company a business associate?<\/summary>\n  <p>If its product handles PHI for a covered entity customer, yes. That triggers a BAA with each customer, full Security Rule obligations, and direct liability to regulators.<\/p>\n<\/details>\n\n<details>\n  <summary>Can a business associate be fined directly?<\/summary>\n  <p>Yes. Since the 2013 Omnibus Rule, HHS can take enforcement action against a business associate directly for Security Rule violations and for certain Privacy Rule provisions, without proceeding through the covered entity.<\/p>\n<\/details>\n\n<details>\n  <summary>What is the conduit exception?<\/summary>\n  <p>A narrow carve-out for organisations that only transmit data without storing it, such as postal services or telecoms carriers. Any persistent storage of PHI takes a vendor outside the exception.<\/p>\n<\/details>\n\n<details>\n  <summary>Do business associates need their own subcontractor BAAs?<\/summary>\n  <p>Yes. Any subcontractor that handles PHI must sign a BAA with the business associate, on terms at least as protective as the upstream agreement.<\/p>\n<\/details>\n\n<p class=\"related\"><strong>Related glossary terms:<\/strong> Covered Entity &middot; Business Associate Agreement &middot; PHI &middot; ePHI &middot; HIPAA Security Rule &middot; HIPAA Breach Notification Rule<\/p>\n\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>A business associate is any organisation that handles protected health information on behalf of a covered entity. Most health software\u2026<\/p>\n","protected":false},"author":8,"featured_media":836,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[180],"tags":[329,331,330],"class_list":["post-835","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-glossary","tag-business-associate","tag-conduit-exception","tag-hipaa-business-associate"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/835","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=835"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/835\/revisions"}],"predecessor-version":[{"id":837,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/835\/revisions\/837"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/836"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=835"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=835"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=835"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}