(1)A person or organization that performs a function or activity on behalf of a covered entity, but is not part of the covered entity's workforce. A business associate can also be a covered entity in its own right. Also see Part II, 45 CFR 160.103. (2)A person to whom the covered entity discloses protected health information so that the person can carry out, assist with the performance of, or perform on behalf of, a function or activity for the covered entity.
- Except as provided in paragraph (2) of this definition, business associatemeans, with respect to a covered entity, a person who:
- On behalf of such covered entity or of an organized health care arrangement (as defined in § 164.501 of this subchapter) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, performs, or assists in the performance of:
- A function or activity involving the use or disclosure of individually identifiable health information, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, billing, benefit management, practice management, and repricing; or
- Any other function or activity regulated by this subchapter;
- A function or activity involving the use or disclosure of individually identifiable health information, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, billing, benefit management, practice management, and repricing; or
- Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation (as defined in § 164.501 of this subchapter), management, administrative, accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangement in which the covered entity participates, where the provision of the service involves the disclosure of individually identifiable health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person.
- On behalf of such covered entity or of an organized health care arrangement (as defined in § 164.501 of this subchapter) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, performs, or assists in the performance of:
- A covered entity participating in an organized health care arrangement that performs a function or activity as described by paragraph (1)(i) of this definition for or on behalf of such organized health care arrangement, or that provides a service as described in paragraph (1)(ii) of this definition to or for such organized health care arrangement, does not, simply through the performance of such function or activity or the provision of such service, become a business associate of other covered entities participating in such organized health care arrangement
- A covered entity may be a business associate of another covered entity.
Related Terms: Business Associate Agreement
What are examples of Business Associates?
Lawyers
Accountants
Consultants
Billing Companies
Collection Agents
Practice Managers
Medical Transcription Service
An employee of the covered entity or a member of the covered entity's own workforce is not considered a business associate. Independent contractors are Business Associates. Also, other health care providers to whom covered entities disclose PHI for treatment purposes are considered business associates, too. This includes other covered entities as well as those not directly affected by HIPAA.
Business Associates need to demonstrate "HIPAA Compliance" by going through the same processes that a covered entity must. This means setting up a manual for HIPAA policies & procedures and training employees. Business Associate version is designed to simplify that process and is offered along side this web site.
A side note: even though HIPAA applies directly to a defined group of "covered entities" and not to others, it is an universal set of privacy guidelines. It is very likely over the long term ALL firms involved with protected health information may see the guidelines apply in other ways. Consider this, if you were to seek care from a medical provider and one says they are HIPAA complaint and follow the guidelines, the other says HIPAA what and has no intention of complying voluntarily, which one would you go to? Same applies to a firm like a lawyer. Suppose you needed an attorney to represent you in a conversation that included your personal medical history, which law firm would you use, one that is HIPAA certified or one that is not? As the public becomes more HIPAA aware, they will expect if not demand privacy compliance.