HITECH Business Associate Direct Liability (45 CFR 160.103, 164.502(a)(3))
Business associates are directly liable for Security Rule compliance, breach notification, certain Privacy Rule provisions, and BAA flow-down to subcontractors.
Primary source
45 CFR 160.103 (Business Associate definition) — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
Pre-HITECH, only covered entities were directly liable for HIPAA violations. Business associates were accountable to covered entities through their BAAs. HITECH and the 2013 Omnibus Rule made business associates directly liable to HHS for certain HIPAA obligations.
45 CFR 160.103 defines "business associate" broadly to include any person who creates, receives, maintains, or transmits PHI on behalf of a covered entity, and explicitly includes subcontractors of business associates.
Direct liability scope (per OCR's fact sheet): full Security Rule compliance (45 CFR 164.302-318); breach notification to the covered entity under 164.410; impermissible uses and disclosures; failure to disclose to HHS for compliance reviews; failure to provide an accounting of disclosures; failure to provide access to ePHI when required by the BAA; failure to enter into a BAA with subcontractors; and failure to comply with the minimum necessary standard.
A business associate that fails to maintain a current risk analysis, fails to encrypt where reasonable, or fails to enter into BAAs with its own subcontractors is now exposed to OCR enforcement on its own — not just contractually to its covered-entity customer.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationHIPAA Business Associate Agreements (45 CFR 164.504(e))Required contract elements for any business associate that creates, receives, maintains, or transmits PHI on behalf of a covered entity.
- RegulationHIPAA Security Rule Business Associate Contracts (45 CFR 164.314)Required specifications for business associate contracts under the Security Rule, complementing the Privacy Rule BAA at 164.504(e).
- RegulationHITECH Act Overview (Pub. L. 111-5, Title XIII)Title XIII of the American Recovery and Reinvestment Act amended HIPAA in 2009 to add breach notification, direct business associate liability, increased penalties, and the Meaningful Use program.
- ComplianceMassachusetts 201 CMR 17.00 for Healthcare: The Written Information Security ProgramMassachusetts 201 CMR 17.00 vs HIPAA for medical practices: mandatory WISP, encryption requirements, M.G.L. c. 93H breach notice, 93A private right of action.
- SRABAA Vendor List: Which Vendors a Small Practice Needs to Sign WithA working list of the vendor categories a small practice typically needs a Business Associate Agreement with under 45 CFR 164.504(e), plus how to handle subcontractor chains.
- ComplianceTexas HB 300 for Medical Practices: Training, Audits, and What Differs from HIPAATexas HB 300 (Health & Safety Chapter 181) vs HIPAA: broader covered entities, mandatory 90-day training, 15-day EHR access, $1.5M/year AG penalty cap.
- SRAChange Healthcare Ransomware: What Small Practices Took AwayThe February 2024 Change Healthcare cyberattack, what HHS and UnitedHealth Group disclosed, and the small-practice lessons about clearinghouse concentration risk, contingency planning, and the Security Rule's information system activity review.
- SRAHIPAA Risk Analysis for a Dental PracticeHow a small dental practice approaches the HIPAA Security Risk Analysis required by 45 CFR 164.308(a)(1)(ii)(A), with practical scope, ePHI flows, and Security Rule references.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.