General information, not legal advice — confirm with your compliance officer or attorney.
What is a business associate? Under HIPAA, it's an outside person or company that handles protected health information (PHI) while doing work for your practice: a billing service, an IT contractor, the host that stores your website's form submissions, or a marketing agency that manages your patient inbox. The label matters because it triggers a business associate agreement (BAA) and direct legal duties for the vendor.
In short: A business associate is anyone outside your workforce who creates, receives, stores or transmits PHI to perform a function or service for your practice. Hosting, IT, billing, CRM and form vendors usually qualify. Marketing agencies qualify the moment they handle patient details, so many practices design that access out on purpose.
What is a business associate? The definition in plain English
The legal definition sits in 45 CFR 160.103 (opens in a new tab). Stripped down, a business associate is someone who, on behalf of your practice and not as a member of its workforce:
- creates, receives, maintains or transmits PHI for a function such as claims processing, data analysis, quality assurance or billing; or
- provides a service that involves PHI, specifically "legal, actuarial, accounting, consulting, data aggregation" and "management, administrative, accreditation, or financial services."
The definition also names health information organizations, e-prescribing gateways and other data transmission providers that need "access on a routine basis," and any subcontractor that handles PHI for another business associate.
Two words do most of the work. "Maintains" means storage alone counts, whether or not anyone reads the files. "Workforce" means employees, volunteers and trainees under your direct control are excluded, because they're part of your practice.
Business associate vs covered entity
Your practice is the covered entity. HIPAA's covered entities are health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with covered transactions, such as claims. See which covered entities the rules reach.
| Item | Covered entity | Business associate |
|---|---|---|
| Who | Your practice | Your vendor that handles PHI |
| Relationship to PHI | Collects it to treat and bill patients | Handles it only to serve the covered entity |
| Contract duty | Must get a BAA before sharing PHI | Must sign one, and get one from its own subcontractors |
| HHS penalties | Yes | Yes, for the requirements it is directly liable for |
The roles can overlap. The definition says a covered entity can be a business associate of another covered entity, for example when one practice provides billing services for another.
Common business associates of a practice
- Website host or platform that stores form submissions, chat transcripts or booking requests.
- Form builder and CRM that receive and keep what patients type.
- IT or managed-services provider with remote access to computers that open the EHR.
- Billing and revenue-cycle company, a function the definition names.
- Cloud storage, backup and email providers holding PHI. The 2013 Omnibus Final Rule preamble says a data storage company "qualifies as a business associate, even if the entity does not view the information" (Federal Register (opens in a new tab)).
- Answering services, transcription and shredding vendors. The Omnibus preamble uses a shredding company as an example of a subcontractor handling PHI.
- Lawyers, accountants and consultants whose work involves patient records.
Each of these needs a signed agreement covering what a BAA must include before PHI moves. Vendors they hire in turn are subcontractors of business associates.
When a marketing agency becomes a business associate
Marketing agencies are where practices most often get this wrong, in both directions. An agency that only sees traffic charts isn't a business associate. One that sees a single patient's inquiry usually is. Illustrative triggers:
- It manages your website forms or inbox. New-patient requests with names and reasons for visit are PHI.
- It receives lead lists that include what each person came in for.
- It uploads patient lists to ad platforms for custom audiences. This also raises marketing authorization questions.
- It replies to reviews using details from a patient's record or visit.
- It logs into your EHR or practice management system to build reports.
If any of these apply, the agency needs a BAA before it starts. The 2013 Omnibus Final Rule made business associates "directly liable" for compliance with certain Privacy and Security Rule requirements, and 45 CFR 160.402 (opens in a new tab) lets HHS impose civil money penalties on business associates as well as covered entities. A good agency will know this. When choosing a healthcare marketing agency, ask which model it works under.
Exceptions: conduits, incidental access, treatment providers
- Conduits. The Omnibus preamble keeps this exception narrow: "mere data transmission services" such as postal couriers and internet service providers, which transport information but access it only "on a random or infrequent basis." The test is the "transient versus persistent nature" of the access. Storage incidental to transmission can fit; a service that keeps your data does not.
- Incidental access. A cleaner, landlord or repair technician isn't performing a function involving PHI. What they might glimpse is incidental, which HIPAA permits only if you've applied minimum necessary rules and safeguards (45 CFR 164.502(a)(1)(iii) (opens in a new tab)). 45 CFR 164.530(c) (opens in a new tab) requires you to "reasonably safeguard" PHI to limit those incidental disclosures.
- Treatment providers. The definition excludes a health care provider receiving PHI "concerning the treatment of the individual." A specialist or lab you send a patient to is a fellow provider, not your vendor.
Keeping vendors out of PHI on purpose
You don't need a BAA with a vendor that never touches PHI, and fewer vendors with PHI means fewer contracts to manage and fewer places for a breach. Designing it out looks like this:
- Give agencies aggregate reports only: leads by channel, calls, form counts. No names, no reasons for visit.
- Keep forms and the inbox in a covered system your staff control, under a BAA with that system's vendor.
- Never share patient lists for ad targeting or "lookalike" audiences without legal review.
- Share the least possible when a vendor does need some access. That's HIPAA's minimum necessary standard.
- Keep analytics off patient pages. Google says it "does not offer Business Associate Agreements" for Google Analytics (Google Analytics Help (opens in a new tab)), so its tags don't belong where patients log in or submit health details.
This is how Medfy is set up. Medfy signs a BAA with each practice before patient data flows, patient information is stored in separate, encrypted HIPAA databases in the US or Canada, and ad platforms never receive patient data; see Medfy's BAA. To check whether your current site leaks data to ad tools, run the free marketing audit. For the full vendor list, start at business associate agreements.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Does a marketing agency need to sign a BAA?
It depends on what the agency touches. If it manages your forms or inbox, receives lead lists with reasons for visit, uploads patient lists to ad platforms or logs into your EHR, it is handling PHI and needs a BAA first. An agency that works only from public pages and aggregate reports usually isn't a business associate. Confirm your arrangement with your compliance officer or attorney.
Is a website host a business associate?
It is if the site stores or processes patient information, such as form submissions, chat transcripts or booking details. HIPAA's definition covers anyone who maintains PHI for you, and the 2013 Omnibus Rule says that applies even when the company never views the data. A host serving only public pages with no patient data is usually not. Confirm your setup with your compliance officer.
Is a cleaning company a business associate?
Usually not. A business associate performs a function or service that involves PHI, and cleaning an office doesn't. What a cleaner might glimpse is incidental, and HIPAA tolerates incidental exposure only when you apply minimum necessary rules and reasonable safeguards, such as locked file rooms and screens that lock. If the contract involves shredding records, that changes. Check edge cases with your compliance officer.
Can a business associate be fined by OCR?
Yes. Since the 2013 Omnibus Rule, business associates are directly liable for compliance with certain HIPAA requirements, and HHS's civil money penalty rule names business associates alongside covered entities. A business associate is also liable for violations by its own agents, including subcontractors. Your practice still has its own duties, so a vendor's liability doesn't replace your BAA or your oversight.