HIPAA Business Associate Agreements (45 CFR 164.504(e))
Required contract elements for any business associate that creates, receives, maintains, or transmits PHI on behalf of a covered entity.
Primary source
45 CFR 164.504(e) — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504#p-164.504(e)
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
45 CFR 164.504(e)) requires a written contract between a covered entity and each business associate. Required terms include: permitted uses and disclosures, prohibition on impermissible use, required safeguards (including Security Rule compliance for ePHI), reporting of unauthorized uses and disclosures, ensuring subcontractor compliance via flow-down BAAs, individual access support, accounting support, amendment support, return or destruction at termination, and breach notification per 164.410.
Since HITECH (2009) and the 2013 Omnibus Rule, business associates are directly liable for Privacy Rule misuse and Security Rule failure. A missing or inadequate BAA is itself a Privacy Rule violation by the covered entity (cited in numerous OCR settlements).
OCR publishes sample BAA provisions to satisfy the regulatory requirements. The sample is a starting point — practices typically layer liability allocation, term, and operational provisions negotiated with counsel, appropriate to the vendor relationship and without weakening the regulatory minimums.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Privacy Rule: General Rules for Uses and Disclosures (45 CFR 164.502)The general rules covered entities follow for any use or disclosure of protected health information, including the minimum necessary standard and treatment, payment, and operations exceptions.
- RegulationHIPAA Breach Notification Rule Overview (45 CFR 164.400-414)When unsecured PHI is accessed, used, or disclosed in a manner not permitted, the entity must follow individual, HHS, and (in some cases) media notification requirements within defined timelines.
- RegulationHITECH Business Associate Direct Liability (45 CFR 160.103, 164.502(a)(3))Business associates are directly liable for Security Rule compliance, breach notification, certain Privacy Rule provisions, and BAA flow-down to subcontractors.
- GlossaryBAA (Business Associate Agreement)A written contract required between a covered entity and any vendor that creates, receives, maintains, or transmits PHI on its behalf.
- RegulationBusiness Associate Breach Notification (45 CFR 164.410)Business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days from discovery, with required content for the covered entity's downstream notifications.
- ComplianceBreach Risk Assessment: The 4-Factor Analysis Required by 45 CFR 164.402After a possible PHI incident, the four-factor breach risk assessment at 45 CFR 164.402 determines whether you notify. Do it in writing, do it on the record.
- SRABAA Vendor List: Which Vendors a Small Practice Needs to Sign WithA working list of the vendor categories a small practice typically needs a Business Associate Agreement with under 45 CFR 164.504(e), plus how to handle subcontractor chains.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.