What is a business associate under HIPAA?
A business associate is a person or company that handles PHI for a covered entity from outside its workforce, and a written contract must be in place first, under 45 CFR 164.502.
A business associate is a person who, on behalf of a covered entity and outside its own workforce, creates, receives, maintains, or transmits PHI. The definition is in 45 CFR 160.103, and a fax service that stores a practice's PHI on the practice's behalf can fall within that definition.
What makes a vendor a business associate?
A business associate is a person who acts on behalf of a covered entity from outside that entity's own workforce. The definition has two parts: that outside role, and the work of creating, receiving, maintaining, or transmitting PHI.
A vendor counts as a business associate because of the work it does for the practice. Paragraph (4) of the same definition lists exclusions.
What must a practice have in place before a business associate handles PHI?
A written contract must be in place before a business associate handles PHI. The rule allows a covered entity to give PHI to a business associate only if it obtains satisfactory assurance that the business associate will appropriately safeguard the information, under 45 CFR 164.502.
That assurance must be documented in a written contract or other written arrangement that meets 45 CFR 164.504(e).
What must the business associate contract say?
The contract must establish the permitted and required uses and disclosures of PHI by the business associate. It may not authorize any use that the Privacy Rule would forbid.
The contract must also require the business associate to report any use or disclosure the contract does not provide for, including breaches of unsecured PHI under 45 CFR 164.410. At termination, the business associate must, if feasible, return or destroy all PHI it still maintains and retain no copies, as 45 CFR 164.504 requires.
Does a fax service need a business associate agreement?
A fax service can need the written contract when it is a business associate, and that depends on the work it does with the practice's PHI. For the practical side, see whether a fax service needs a BAA.
Fax Pigeon signs a BAA at signup on every plan. Its terms are on Fax Pigeon's BAA page.
Which terms get confused with a business associate?
Three terms are easy to mix up with a business associate.
- Covered entity: the health plan, clearinghouse, or provider that the business associate works for.
- Workforce: the covered entity's own workforce. Its members fall outside the business associate definition.
- Protected health information (PHI): the health information a business associate creates, receives, maintains, or transmits for the covered entity.
* Fax Pigeon prices and plan terms as of October 16, 2026.
Frequently asked questions
- What is a business associate under HIPAA?
- A business associate is a person who, on behalf of a covered entity and outside its own workforce, creates, receives, maintains, or transmits PHI. A covered entity may give PHI to a business associate only with satisfactory assurance of safeguards, documented in a written contract.
- Which regulation defines a business associate?
- 45 CFR 160.103 defines a business associate. The contract requirements sit in 45 CFR 164.502 and 164.504, which say what the covered entity must obtain and what the written contract must contain. Those sections apply whenever a practice gives PHI to a vendor that qualifies.
- Why does business associate status matter for a small practice?
- Business associate status decides which vendors need a written contract before they handle the practice's PHI. The contract must set permitted uses and disclosures, require reporting of uses the contract does not provide for, and return or destroy PHI at termination if feasible. A small practice needs that contract for every vendor that qualifies.
- How does business associate status apply to faxing?
- A fax service that stores a practice's PHI on the practice's behalf can fall within the definition, so the written contract requirement can apply to it. Whether a given fax service fits the definition depends on what it does with the PHI.
Fax Pigeon
HIPAA-compliant fax with a signed BAA on every plan
Plans start at $4.99 a month, billed annually, for 200 pages, with your own number and unlimited people. Your first fax is free.
- Free porting of your local number
- Fax from your email
- AI summary of every inbound fax
- E-signatures
- Contact management
- Delivery proof
Know a practice that still faxes? Refer it through the referral program and earn 20% of its plan, every month it stays.