HIPAA Security Rule Business Associate Contracts (45 CFR 164.314)
Required specifications for business associate contracts under the Security Rule, complementing the Privacy Rule BAA at 164.504(e).
Primary source
45 CFR 164.314 — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.314
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
45 CFR 164.314 sets the Security Rule's requirements for business associate contracts and arrangements. The standard supplements — but does not replace — the Privacy Rule BAA requirements at 164.504(e).
The business associate contract must provide that the business associate will:
- Comply with the applicable requirements of the Security Rule (164.302-318).
- Ensure that any subcontractor that creates, receives, maintains, or transmits ePHI on behalf of the business associate agrees to comply with the applicable Security Rule requirements through a written contract.
- Report any security incident of which it becomes aware (including breaches of unsecured PHI under 164.410).
When the covered entity and business associate are both government entities, a memorandum of understanding may substitute for a contract, provided it accomplishes the same objectives.
In practice, a single BAA typically satisfies both the Privacy Rule requirements at 164.504(e) and the Security Rule requirements at 164.314 — OCR's sample BAA covers both. Practices that rely on legacy BAAs drafted before 2013 should verify they include the post-HITECH Omnibus Rule terms, particularly subcontractor flow-down and direct liability acknowledgment.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Administrative Safeguards (45 CFR 164.308)Nine standards covering security management, workforce security, training, contingency planning, incident procedures, evaluation, and business associate contracts.
- RegulationHIPAA Business Associate Agreements (45 CFR 164.504(e))Required contract elements for any business associate that creates, receives, maintains, or transmits PHI on behalf of a covered entity.
- RegulationHITECH Business Associate Direct Liability (45 CFR 160.103, 164.502(a)(3))Business associates are directly liable for Security Rule compliance, breach notification, certain Privacy Rule provisions, and BAA flow-down to subcontractors.
- SRAHIPAA Security Rule vs Privacy Rule: A Plain-English MapWhat the Security Rule at 45 CFR Part 164 Subpart C does, what the Privacy Rule at Subpart E does, where they overlap, and which rule the SRA actually answers to.
- RegulationHIPAA Security Access Control (45 CFR 164.312(a))Technical policies and procedures for systems containing ePHI to allow access only to those granted access rights, with required specifications for unique user identification and emergency access.
- ComplianceHIPAA Contingency Plan Template — 45 CFR § 164.308(a)(7)2026 HIPAA contingency plan template — 45 CFR § 164.308(a)(7) data backup, DRP, emergency mode, testing, and applications/data criticality analysis.
- GlossaryAccess ControlsTechnical policies and procedures that allow only authorized persons or software programs to access ePHI.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.