According to current HIPAA regulations, the definition of a "business associate" is any entity that uses or discloses protected health information (PHI) on behalf of a covered entity (e.g. group health plan,  hospital, etc.).

Furthermore, it is any person who, on behalf of a covered entity, performs (or assists in the performance of) a function or activity involving the use or disclosure of PHI.  [45 CFR § 160.103.] Download this easy flow chart to determine if you or your organization is a Business Associate.

Examples of functions or activities that involve the use of disclosed PHI given in the HIPAA regulations include:

[45 CFR § 160.103.]

In addition, HIPAA regulations specifically identify the following services which, if they involve PHI and if they are performed by a non-workforce member, will make that person or entity a business associate:

1

|

2

|

3