Healthcare operations glossary › Business associate
A business associate is a vendor that handles patient information to do work for your practice. What makes a vendor one is what it does with that information, not what it calls itself. If a vendor qualifies, the practice needs a signed agreement with it before any patient information is shared.
Definition
A business associate is a person or company outside a practice's workforce that creates, receives, maintains or transmits protected health information on the practice's behalf to perform a service for it.
The test is simple. If a vendor creates, receives, maintains or transmits protected health information (PHI) to do a job for a covered entity such as your practice, it is likely a business associate.
In practice at a clinic or small practice
Vendors that commonly qualify include outside billing companies, IT or managed service providers, cloud storage services, answering services, shredding companies, transcription services and staff messaging tools that hold PHI. Office managers usually run into the term when onboarding a new vendor or tool. Ask one question: will this vendor touch patient information? If the answer is yes, get a signed BAA before any PHI goes in.
Front desk staff and nurses run into the term indirectly. Do not use a tool without a BAA, such as a personal texting app or a free tier with no BAA, to share patient details. This applies even to quick operational questions like "Can someone call back the 2:30 patient about their referral?" A staff chat vendor like Chanty signs a BAA on its Business and Enterprise plans, not on its Free plan.
Integrations matter too. Automation platforms and file storage services that a tool connects to may be separate business associates, and each may need its own BAA. A chat vendor's BAA does not automatically extend to them.
Not to be confused with
| Term | What it is | How it differs |
|---|---|---|
| Covered entity | A health plan, a health care clearinghouse, or a provider that conducts standard electronic transactions. This is usually the practice itself. | The business associate works on the covered entity's behalf. |
| business associate agreement (BAA) | The contract. | The business associate is the vendor. The BAA is the document it signs. |
| Workforce members | Employees, volunteers and trainees under the practice's direct control. | They are workforce, not business associates, so staff do not sign BAAs. |
| Mere conduits | Services that only transport data and store it no longer than transmission requires, such as a postal service or internet provider. | They are generally not business associates. |
What the rules say
- Definition. The definition of business associate appears in the HIPAA Administrative Simplification regulations.
- Written assurances. A covered entity may share PHI with a business associate only after obtaining satisfactory assurances, normally a written contract. The Security Rule contains a parallel requirement.
- Subcontractors. A subcontractor that handles PHI for a business associate is a business associate too, and it needs its own agreement with that business associate.
- Direct liability. Business associates can be directly liable for certain HIPAA violations.
- Sample provisions. HHS publishes sample BAA provisions that practices can compare their contracts against.
This is a summary, not legal advice. Before deciding whether a specific vendor needs a BAA, ask your privacy officer or counsel.
Related reading
- business associate agreement (BAA): what the contract must include.
- covered entity: who HIPAA applies to first.
- Security, HIPAA and BAA: how one staff chat vendor handles its BAA and plan scope.
- Back to the Healthcare operations glossary.
Where Chanty fits. chanty.health is published by Chanty, a team chat for clinic staff with a signed BAA from the Business plan. If your team still coordinates in personal group chats, see how HIPAA-compliant staff chat works or start free.