Business associate agreement
By Gareth HoyleLast updated How we research
A business associate agreement is the HIPAA contract a covered entity must sign with any vendor that handles protected health information on its behalf.
A business associate agreement is a contract required by HIPAA between a covered entity, such as a health plan or provider, and a business associate that creates, receives, maintains or transmits protected health information on its behalf. 45 CFR 160.103 lists data analysis, billing, legal, consulting and data aggregation among business associate functions.
What must a business associate agreement say?
HHS publishes sample provisions. The agreement must limit the vendor's uses and disclosures to those it permits, require safeguards, require breach reporting and require return or destruction of the data at the end of the contract.
Can a business associate license data for AI training?
A business associate generally cannot license protected health information for AI training. Under 45 CFR 164.502(a)(5)(ii), a covered entity or business associate "may not sell protected health information" without an authorization from each individual. A vendor that wants to license health data generally needs it properly de-identified first, and should check that its agreement allows it to de-identify the data.
Under UK and EU GDPR the nearest equivalent is a data processing agreement between a controller and a processor.