General information, not legal advice — confirm with your compliance officer or attorney.
A business associate agreement subcontractor clause is what keeps HIPAA's protections attached to patient data as it moves from your vendor to the companies your vendor relies on. Your website platform runs on a cloud host; your form tool sends notifications through an email service; your chat widget calls an AI model. Each of those companies, if it handles your patients' information, needs its own BAA with the vendor above it.
In short: A subcontractor is a company your vendor hands part of its work to. If that work involves PHI, HIPAA requires a written BAA between your vendor and the subcontractor with the same restrictions as yours. You don't sign it yourself, but your BAA should require it, and you should know who's in the chain.
What a subcontractor is under HIPAA
45 CFR 160.103 (opens in a new tab) defines a subcontractor as "a person to whom a business associate delegates a function, activity, or service," other than a member of its own workforce. The same section says a business associate includes "a subcontractor that creates, receives, maintains, or transmits protected health information" on behalf of another business associate.
That second sentence is the important one. A subcontractor handling PHI is itself a business associate, with the same direct duties, not just a vendor's vendor. If you need the base definition first, see who counts as a business associate.
How the subcontractor business associate agreement chain works
Three provisions build the chain:
- 45 CFR 164.502(e)(1)(ii) (opens in a new tab) lets a business associate pass PHI to a subcontractor only after obtaining satisfactory assurances that it will safeguard the information.
- 45 CFR 164.308(b)(2) (opens in a new tab) applies the same rule to electronic PHI.
- 45 CFR 164.504(e)(5) (opens in a new tab) applies the BAA content requirements to contracts between a business associate and its subcontractors.
The 2013 Omnibus Final Rule is where this came from. Its preamble says obligations extend "down the chain" through every tier of subcontractor (Federal Register, January 25, 2013 (opens in a new tab)). The rule took effect March 26, 2013, with compliance required by September 23, 2013.
Each arrow in the chain is a separate agreement:
| Link | Who signs | What it covers |
|---|---|---|
| Practice → vendor | You and your vendor | Your BAA: uses, safeguards, reporting, flow-down |
| Vendor → cloud host or AI provider | Your vendor and its subcontractor | Same restrictions, passed down |
| Cloud host → backup or support provider | The subcontractor and its own subcontractor | Same restrictions again, if PHI reaches them |
Liability follows the chain too. A business associate is liable for violations by its agents, including subcontractors (45 CFR 160.402(c) (opens in a new tab)).
Real chains: website hosting, forms, CRM, AI chat
Website hosting. Your website vendor stores form submissions on a cloud platform. Microsoft's HIPAA page says that when a business associate subcontracts with a cloud provider to handle PHI, "the cloud service provider also becomes a business associate" (Microsoft Learn (opens in a new tab)). Cloud BAAs are often limited to listed services: Google Cloud says to "disable unsupported Google Cloud services" when working with PHI (Google Cloud (opens in a new tab)). Our guide to HIPAA-compliant hosting covers what to require.
Forms. A form tool may store submissions with one provider and send email notifications through another. If the notification contains the patient's answers, the email service is in the chain too.
CRM. Platform BAAs often stop at the platform's edge. Salesforce's BAA restrictions page says customers are responsible for the HIPAA compliance of third-party LLM providers used with its Einstein GPT services (Salesforce (opens in a new tab)). Add-ons and integrations need their own answer.
AI chat. A chat widget that sends patient messages to an AI model makes the model provider a subcontractor. Ask whether the widget vendor has a BAA with that provider, and whether the provider retains or trains on the messages. See AI vendors and HIPAA.
Agencies that resell other platforms
Illustrative example: a marketing agency runs your website, forms and patient follow-up on a third-party CRM platform it licenses. Two agreements are needed:
- Practice ↔ agency. The agency handles your patients' information, so it's your business associate.
- Agency ↔ platform. The platform stores that information for the agency, so it's a subcontractor and needs a BAA with the agency.
Some platforms build this in. HighLevel says it "is not HIPAA compliant by default"; the agency must buy and activate a HIPAA module, listed at "$297 per month (or $2,970 per year)," and "complete a Business Associate Agreement" (HighLevel (opens in a new tab)). Ask your agency for proof that its platform account is set up that way. Our note on agency platforms like GoHighLevel has the details.
What to ask a vendor about its subcontractors
Three questions, in writing, before you sign:
- Which subcontractors receive PHI? Hosting, backup, email, SMS, AI, support tools. Ask for names, not categories.
- Does each have a BAA with you? Your BAA should require it; ask the vendor to confirm it's in place, not planned.
- Where is data stored and backed up? Country and provider, including backups and disaster recovery copies.
Then put a notice requirement in your BAA so you hear before a new subcontractor is added. The BAA clause checklist lists the flow-down clause to look for.
Medfy signs a BAA with each practice, and patient data is stored in separate, encrypted HIPAA databases in the US or Canada; see Medfy's HIPAA safeguards. For the vendor-by-vendor view, start at business associate agreements, or run the free marketing audit to find tools on your site that may be sending data where they shouldn't.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Do subcontractors of business associates need a BAA?
Yes, if they create, receive, store or transmit PHI for your vendor. HIPAA requires your vendor to get written assurances from each such subcontractor, in a contract with the same restrictions as your BAA, and the duty repeats at every tier down the chain. A subcontractor that never touches PHI doesn't need one. Confirm specific arrangements with your compliance officer or attorney.
Does the practice sign the subcontractor BAA?
No. The regulation says a covered entity doesn't have to obtain assurances from a business associate that is a subcontractor; your vendor signs with its subcontractors. Your job is to make sure your own BAA requires that flow-down and to ask which subcontractors receive your data. Keep the vendor's answer on file, and have counsel review the clause if it's vague.
Is a cloud hosting company a subcontractor?
It is when your vendor uses it to store or process your patients' information. The 2013 Omnibus Rule says a company that stores PHI is a business associate even if it never views the data, and Microsoft's HIPAA page says a cloud provider a business associate uses for PHI also becomes a business associate. Your vendor needs that host's BAA. Confirm details with your compliance officer.
How do we find out which subcontractors a vendor uses?
Ask in writing before you sign: which subcontractors receive PHI, whether each has a BAA with the vendor, and where data is stored and backed up. Many vendors publish a subprocessor list; ask whether it covers PHI specifically. Write a notice requirement for new subcontractors into your BAA, and confirm the arrangement with your compliance officer or attorney.