Business associate contracts and other arrangements
Summary
A covered entity may only allow a business associate to create, receive, maintain, or transmit ePHI on its behalf if it obtains satisfactory assurances -- generally a written Business Associate Agreement (BAA) -- that the associate will appropriately safeguard the information.
administrative safeguardsbusiness associatesvendor risk
Read the full official text: https://www.law.cornell.edu/cfr/text/45/164.308
Track HIPAA section 164.308(b) as evidence
eurocompliant maps this obligation to a checklist task and the evidence that satisfies it, alongside every other framework you follow.
Start free trial