What Is a Business Associate Under HIPAA? With Examples

Under HIPAA, a business associate is a person or company, other than a member of the workforce, that creates, receives, maintains or transmits protected health information (PHI) on behalf of a covered entity, or provides certain services to it that involve PHI, as defined in 45 CFR 160.103 (eCFR). HHS tells healthcare organizations to check whether each tracking technology vendor meets that definition (HHS). Curve Compliance acts as a business associate for the ad tracking it runs and signs a BAA on every plan.

Book a call. If your website sends data to ad platforms, every vendor in that path matters. Curve Compliance sends conversions server-side, strips PHI before data reaches an ad platform, and signs a BAA on every plan. Book a call with Curve.

The legal definition

The definition in 45 CFR 160.103 has two prongs (eCFR). A person is a business associate of a covered entity if, other than as a workforce member, it:

• Handles PHI on the covered entity's behalf. On behalf of the covered entity, or an organized health care arrangement it takes part in, it "creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter," meaning the HIPAA administrative simplification rules, such as claims processing, data analysis, utilization review, quality assurance, billing, benefit management or practice management (eCFR; HHS).
• Provides a service that involves PHI. It provides "legal, actuarial, accounting, consulting, data aggregation" or "management, administrative, accreditation, or financial services" to the covered entity, where providing the service involves disclosing PHI from the covered entity, or from another of its business associates, to the person providing it (eCFR).

The rule names some business associates outright: health information organizations and e-prescribing gateways that need routine access to PHI, a company offering a personal health record on behalf of a covered entity, and any subcontractor that handles PHI for a business associate (eCFR). For what counts as PHI on a website, see what counts as PHI.

The test is about what the vendor does, not what it signed. HHS's tracking guidance says a vendor "is a business associate if it meets the definition of a business associate, regardless of whether the required BAA is in place," and that signing an agreement with BAA terms "does not make a tracking technology vendor a business associate if the tracking technology vendor does not meet the business associate definition" (HHS).

Business associate vs covered entity

	Covered entity	Business associate
Who it is	A health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a covered transaction (160.103)	A person or company that handles PHI on behalf of a covered entity, or provides certain services to it that involve PHI (160.103)
Examples	Doctors, clinics, dentists and pharmacies that send standard transactions, such as claims, electronically; health insurers, HMOs and Medicare (HHS)	Third party administrators, CPA firms, cloud service providers, IT contractors (HHS)
Which rules apply	The HIPAA standards apply to it directly (160.102(a))	They apply "Where provided" (160.102(b)), plus everything in its BAA
Who it needs a BAA with	Each business associate (164.502(e)(1)(i))	Each subcontractor that handles PHI for it (164.502(e)(1)(ii))
Breach reporting	Notifies affected individuals, HHS and, for a breach involving more than 500 residents of a State or jurisdiction, the media (164.404; 164.406; 164.408), and receives breach reports from its business associates (164.504(e)(2)(ii)(C))	Must report breaches to the covered entity (HHS)

One organization can be both: "A covered entity may be a business associate of another covered entity" (160.103). For the full covered entity test, see what a HIPAA covered entity is.

Examples of business associates

HHS lists these among its examples (HHS):

• Claims and benefits. A third party administrator that helps a health plan with claims processing, a pharmacy benefits manager, and a clearinghouse that translates a provider's claims into a standard transaction.
• Cloud and IT. A cloud service provider that stores or processes electronic PHI, an EHR vendor or managed services provider that supports systems holding it, and a technician servicing a copier or medical device that stores PHI.
• Apps and data exchange. A health app developer that contracts with a covered entity to give its patients an app and handles their PHI on the covered entity's behalf, a personal health record vendor working for a covered entity, and health information exchanges.
• Professional services. A CPA firm or attorney whose work involves access to PHI, a utilization review consultant, a patient safety organization, and a medical transcriptionist.

Marketing and tracking vendors are judged the same way. HHS says "tracking technology vendors are business associates if they create, receive, maintain, or transmit PHI on behalf of a regulated entity for a covered function" or provide certain services involving PHI (HHS). The same test applies to the CRMs, form builders, scheduling tools and call tracking services that hold patient details for you, and the BAA Directory records which of them sign a BAA.

Who is not a business associate

• Your workforce. Workforce means "employees, volunteers, trainees, and other persons" whose conduct is "under the direct control of such covered entity or business associate," paid or not (160.103).
• Conduits. The US Postal Service, certain couriers and their electronic equivalents. HHS says a conduit "transports information but does not access it other than on a random or infrequent basis" (HHS FAQ), and "Entities that access PHI on a regular or frequent basis to perform a service on behalf of a covered entity are not conduits" (HHS).
• Providers treating the patient. The rule excludes "A health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual" (160.103).
• Incidental access. A janitorial service or electrician whose work does not involve PHI, if access is only incidental and safeguards are in place (HHS).

For every case where PHI can be shared without a BAA, see when you don't need a BAA.

Subcontractors are business associates too

A subcontractor is "a person to whom a business associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate" (160.103). If it handles PHI, it is a business associate in its own right. HHS says "All such downstream subcontractors are also business associates," and a business associate "must establish a BAA with its subcontractor before disclosing PHI to the subcontractor" (HHS). See the BAA template guide for subcontractor terms.

What business associates must do

A business associate is bound twice: by its BAA, and directly by parts of HIPAA. HHS says "In 2009, Congress enacted the Health Information Technology for Economic and Clinical Health (HITECH) Act," making business associates directly liable for certain requirements, and OCR "issued a final rule in 2013" to apply them (HHS). HHS can act against a business associate directly for (HHS):

• Security Rule failures. Not complying with the Security Rule.
• Breach notice. Not notifying the covered entity, or another business associate, of a breach.
• PHI misuse. Uses and disclosures of PHI that are not permitted, and not limiting PHI to the minimum necessary.
• Subcontractors. Not signing BAAs with subcontractors, or not acting on a subcontractor's material breach.
• HHS and patients. Not giving HHS records or cooperating with investigations, retaliating against complainants, and certain failures on electronic copies of PHI and accountings of disclosures.

Is a marketing agency a business associate?

It can be, under the same test as any vendor. An agency that creates, receives, maintains or transmits PHI on a covered entity client's behalf, such as patient lists or booking records, or receives PHI to provide consulting or management services, meets the definition (160.103). One that never receives PHI does not, and HHS says signing BAA terms does not change whether a vendor meets it (HHS). Agencies that do meet it should read what an agency BAA commits you to. For your own arrangements, talk to your counsel.

How Curve Compliance helps

Curve Compliance acts as your business associate for ad tracking and signs a BAA on every plan, before live tracking begins (BAA Directory entry). The ad platforms at the end of the path are a different matter: the BAA Directory lists Meta and Google Ads as not signing one; see which ad platforms sign a BAA.

Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week.

Sources, checked October 26, 2026: 45 CFR 160.103; 45 CFR 160.102; 45 CFR 164.502; HHS, Business Associates FAQs; HHS, Direct Liability of Business Associates; HHS, Use of Online Tracking Technologies; HHS, Guidance on HIPAA and Cloud Computing; HHS FAQ 245; HHS, Covered Entities and Business Associates; 78 FR 5566.

Frequently Asked Questions

What is the definition of a business associate under HIPAA?

A business associate is a person or organization, other than a workforce member, that creates, receives, maintains or transmits PHI on behalf of a covered entity, or provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial services to it that involve disclosing PHI to the business associate (45 CFR 160.103). A subcontractor that handles PHI for a business associate is one too.

Who qualifies as a business associate?

Anyone outside your workforce who creates, receives, maintains or transmits PHI on your behalf, or who receives PHI from you to provide one of the services the rule lists, such as legal, accounting or consulting work (45 CFR 160.103). HHS's examples include claims administrators, cloud and IT vendors, app developers, accountants, lawyers and transcriptionists (HHS), and tracking vendors qualify when they handle PHI for a covered function (HHS).

What are the duties of a business associate?

Follow its BAA, comply with the Security Rule, report breaches to the covered entity, use and disclose PHI only as permitted, limit PHI to the minimum necessary, and sign BAAs with its own subcontractors. HHS can take enforcement action against the business associate directly for every duty on that list except following the BAA, which is a contract obligation (HHS; HHS).

What is an example of a business associate for HIPAA?

A cloud provider that stores a clinic's electronic PHI is one, HHS says, even if it "lacks an encryption key for the data" (HHS). Other HHS examples are a third party administrator processing a health plan's claims and a CPA firm whose work involves PHI (HHS).

Are business associates required to be HIPAA compliant?

Yes, in part. HHS says a business associate "is also directly liable for complying with certain provisions of the HIPAA Rules," including the Security Rule (HHS; fact sheet). Its other duties are the terms of its BAA: "In addition to these contractual obligations, business associates are directly liable for compliance with certain provisions of the HIPAA Rules" (HHS).

For which of the following is a business associate contract not required?

None is needed for disclosures to a provider for the patient's treatment, to a health plan for payment, through a conduit such as the US Postal Service, or to someone whose access to PHI is only incidental, such as a janitorial service (HHS; HHS FAQ). See when you don't need a BAA.

Which rule expanded HIPAA compliance requirements to include business associates?

The HITECH Act of 2009 made business associates directly liable for certain HIPAA requirements, and HHS's 2013 Omnibus Final Rule, published January 25, 2013, wrote that into the regulations (HHS fact sheet; HHS; 78 FR 5566). See what the HITECH Act changed.

What is the difference between a covered entity and a business associate?

A covered entity is a health plan, a clearinghouse, or a provider that transmits health information electronically in a covered transaction; a business associate handles PHI on a covered entity's behalf (45 CFR 160.103). See what a covered entity is.

Talk to Curve Compliance

Book a call. Ad tracking that touches PHI belongs with a vendor that signs a BAA. Curve Compliance signs one on every plan, sends conversions server-side and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.