Are you a business associate?
The definition is about function, not industry. You're a business associate if, on behalf of a covered entity or another business associate, you create, receive, maintain or transmit protected health information. Software companies, billing and coding services, clearinghouses acting for providers, IT and managed service providers, cloud hosts, transcription services, shredding companies, consultants, lawyers and accountants who see records: all in.
Not business associates: your customer's own employees, companies that only transmit data without storing or accessing it (the conduit exception, read narrowly), and a workforce member of the covered entity. A consumer app with no provider involved isn't one either; it's the FTC's problem. Use the BAA checker if a specific relationship is unclear.
What applies to you directly
Before the HITECH Act and the 2013 Omnibus Rule that implemented it, business associates were bound only by contract. Today you're directly liable for:
- The entire Security Rule. Risk analysis, risk management, every administrative, physical and technical safeguard, documentation for six years. Nothing is diluted because you're a vendor.
- The Breach Notification Rule, as it applies to notifying the covered entity.
- The Privacy Rule to the extent of your BAA: using and disclosing PHI only as the agreement allows, the minimum necessary standard, and supporting patient access requests.
- Subcontractor agreements. Every vendor you hand PHI to needs its own BAA with you, with the same obligations flowed down.
Your customer's BAA is not a shield. It's a second set of obligations on top of the law.Your engineer
What OCR has fined business associates for
Business associate penalties follow the same pattern as providers': a breach report, an investigation, and a missing or inadequate risk analysis.
- MMG Fusion, 2026, $10,000. A Maryland software company that sells practice-growth tools to dental offices. A breach affecting roughly 15 million people, no risk analysis, a three-year corrective action plan. OCR said it considered the company's financial condition.
- Elgon Information Systems, 2025, $80,000, and Virtual Private Network Solutions, 2025, $90,000. An EHR and billing support provider and a data hosting provider, both to healthcare. Ransomware, and no accurate and thorough risk analysis.
- Larger vendors have paid seven figures in earlier years for the same finding after bigger breaches.
Two things stand out. Small vendors are not too small to be investigated. And the finding is almost never exotic.
The business associate agreement, from your side
You'll sign a lot of them, and customers will send you theirs. Know what has to be in it and what you can negotiate.
| Term | Required by the rule? | Watch for |
|---|---|---|
| Permitted uses and disclosures | Yes | Make sure your actual product features fit inside them, including analytics and support. |
| Safeguards and Security Rule compliance | Yes | Standard. You're already bound by law. |
| Breach and incident reporting | Yes | The rule allows 60 days; customers often demand 5 or fewer. Negotiate a number you can meet. |
| Subcontractor flow-down | Yes | Every subprocessor needs a BAA. Keep the list current. |
| Patient rights support | Yes | Access, amendment, accounting of disclosures: know how you'd respond. |
| Return or destruction at termination | Yes | Backups and logs: define what "destroy" means for them. |
| Audit rights, indemnities, insurance minimums | No | Commercial terms. Negotiate scope, notice and caps. |
Your checklist, in order
- Inventory where PHI lives in your product, your support tools, your backups and your laptops.
- Do the risk analysis and keep it current. It's the one document every investigation asks for.
- Sign BAAs both ways: with customers before you receive PHI, and with every subprocessor before you share it.
- Encrypt and MFA everything. Then you can say so in security questionnaires.
- Write the breach procedure against the shortest reporting window in any BAA you've signed.
- Train everyone who could touch PHI, including engineers and support.
- Keep the pack ready for customers' security reviews and for OCR. Most buyers will also ask for SOC 2.
With AccuSights: we build the program a hospital's security team expects to see from a vendor: risk analysis, policies, subcontractor BAAs tracked with renewal dates, device evidence from the endpoint agent, and a reviewer portal you can open for any customer's due diligence. Controls are mapped to SOC 2 for when the deal needs the report.