What is a HIPAA business associate?
A HIPAA business associate is a person or entity that performs certain functions or activities involving the use or disclosure of protected health information (PHI) on behalf of, or through the provision of services to, a covered entity. For example, health plans, health care clearinghouses, and certain health care providers.
Most providers and plans do not carry out all of their health care activities and functions by themselves; they often use the services of other persons and businesses. The HIPAA Privacy Rule allows covered entities to disclose protected health information to these business associates if the providers or plans obtain satisfactory assurances the business associate will:
- Use the information only for the purposes they’ve been engaged
- Safeguard the information from misuse
- Help the covered entity comply with some of the covered entity’s duties under the Privacy Rule
HIPAA Rules apply to covered entities as well as business associates. Suppose a covered entity engages a business associate to help carry out its health care activities and functions. In that case, the business associate must comply with HIPAA, and the covered entity must have a written business associate contract or another arrangement with the business associate that establishes the engagement specifics.
Covered entities may disclose protected health information to an entity in its role as a business associate only to help the covered entity carry out its health care functions—not for the business associate’s independent use or purposes, except as needed for the proper management and administration of the business associate.
Join our upcoming webinar, where leading cybersecurity experts Ciaran Martin and Victoria Baines will discuss findings from Vanta’s second annual State of Trust Report. Understand the risks facing UK organisations, why good security means good business and how to minimise manual security work through AI and automation.
Join Danny Sheridan, Co-founder and CEO at Fern (YC W23), and Brian Kuan, Product Marketing Manager at Vanta (YC W18), for a deep dive into why startups should prioritize compliance early in their journey, and how Vanta can help you become SOC 2-ready in as little as four weeks—giving time back for you to focus on building a company.
Join our upcoming webinar, where leading cybersecurity experts Ciaran Martin and Victoria Baines will discuss findings from Vanta’s second annual State of Trust Report. Understand the risks facing UK organisations, why good security means good business and how to minimise manual security work through AI and automation.
Join Danny Sheridan, Co-founder and CEO at Fern (YC W23), and Brian Kuan, Product Marketing Manager at Vanta (YC W18), for a deep dive into why startups should prioritize compliance early in their journey, and how Vanta can help you become SOC 2-ready in as little as four weeks—giving time back for you to focus on building a company.
Curious about why compliance is so important, which businesses need it, and how Vanta's automation can help you quickly achieve it? Join Vanta’s 45-minute live product demo where you’ll learn how Vanta goes beyond compliance to enhance your overall security and trust management.
Watch our Coffee and Compliance session, where our experts, Ethan Heller, GRC, Subject Matter Expert at Vanta, and Brad Dispensa,WWPS Specialist SA at Amazon Web Services (AWS) cover some of the challenges of SOC 2 compliance and show how Vanta and AWS work together to simplify and accelerate SOC 2 compliance.
We had the pleasure of hosting Jeremy Epling, Vanta’s CPO from our Vanta Sydney office, where he shares and demonstrates some exciting new product updates designed to help security teams future-proof and scale their GRC programs more easily.
.svg)
.svg)
