By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: BA (Business Associate)
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
A business associate (BA) is, in general, a person or organization that works with a HIPAA covered entity and handles protected health information (PHI) in a role other than as a member of the covered entity’s workforce. Under 45 CFR 160.103, a business associate is someone who, on behalf of a covered entity, creates, receives, maintains, or transmits PHI for a function regulated by HIPAA, such as claims processing, data analysis, utilization review, quality assurance, patient safety activities, billing, benefit management, or practice management. It also includes someone who provides services such as legal, accounting, consulting, data aggregation, accreditation, or financial work to a covered entity when the service means PHI is disclosed to them. The HIMSS Dictionary reproduces this regulatory definition.
The regulation names several specific cases. A health information organization, an e-prescribing gateway, or another person that provides data transmission services for PHI and needs routine access to it is a business associate. So is a person that offers a personal health record to individuals on behalf of a covered entity, and a subcontractor that creates, receives, maintains, or transmits PHI on behalf of a business associate. A covered entity may also be a business associate of another covered entity. Some relationships are excluded, for example a health care provider receiving PHI for treatment of the individual.
| Example Vendor | Why It May Be a BA | Typical Concern |
|---|---|---|
| Billing or coding company | Handles claims and patient accounts | Access to demographics and diagnoses |
| Cloud or hosting provider | Maintains ePHI on servers | Security and availability |
| EHR vendor with hosting or support access | Maintains or accesses ePHI | Remote support access |
| Transcription or AI documentation service | Creates and processes clinical notes | Retention and reuse of data |
| Health information exchange | Transmits PHI between organizations | Consent and routing |
| Shredding or storage service | Maintains records containing PHI | Chain of custody |
⚠️ Exam Alert: A BA is defined by function, not by the vendor’s own label: if the service involves creating, receiving, maintaining, or transmitting PHI, the vendor is a BA. A business associate agreement (BAA) is the required contract. A subcontractor of a BA is also a BA. A workforce member is not a BA, and a provider receiving PHI for treatment is not a BA for that disclosure.
🌐 Why It Matters: Real-World Healthcare IT Context
Modern health care depends on vendors. Hospitals use outside companies for billing, cloud hosting, analytics, scheduling, transcription, patient messaging, and security monitoring. Each relationship moves PHI outside the covered entity, so HIPAA requires a written contract or other arrangement with specific terms. The Privacy Rule at 45 CFR 164.504(e) says the contract must establish the permitted and required uses and disclosures. It must also require the business associate to: not use or further disclose the information other than as permitted by the contract or by law; use appropriate safeguards and comply with the Security Rule for electronic PHI; report any use or disclosure not provided for by the contract, including breaches of unsecured PHI; ensure that its subcontractors agree to the same restrictions; make PHI available for access, amendment, and accounting of disclosures; and make its internal practices, books, and records available to the Secretary for determining compliance. The Security Rule’s administrative safeguards at 164.308(b) add parallel requirements for obtaining satisfactory assurances.
Since the HITECH Act and the 2013 Omnibus Rule, business associates are directly responsible for compliance with parts of HIPAA, not only through their contracts. Two research studies show the policy’s impact and the remaining risk. A 2018 study in the Milbank Quarterly used data on breaches reported to the Office for Civil Rights from October 2009 to August 2017, with interrupted time-series and difference-in-differences analyses. It found that implementation of the Omnibus Rules led to a significant reduction in the number of breaches among business associates, estimating that 180 breaches were prevented that could have affected nearly 18 million people. The authors presented it as evidence that regulatory action can protect privacy.
More recent data show a different trend. A 2026 longitudinal analysis in JMIR Medical Informatics examined 6,612 health care data breaches reported to OCR between October 2009 and December 2025. Business associate involvement accounted for 1,950 breaches, or 29.5 percent, but 285,718,494 affected individuals, or 48.8 percent of the total. The annual rate of BA involvement rose from 22.1 percent in the pre-Omnibus period to 36.6 percent in 2020 to 2025, with an 8 percent annual increase in the odds of BA involvement. Hacking and IT incidents became the dominant mechanism, and breaches involving network servers rose by 29 percent per year in odds. BA-involved breaches were more concentrated in hacking (65.7 percent versus 50.4 percent) and network servers (55.6 percent versus 30.8 percent), and more often reached 100,000 or more individuals (12.4 percent versus 8.2 percent). The analysis depends on how breaches are flagged as BA-related in the public portal, so counts may be imperfect, but the direction is clear: concentration of data in vendors concentrates risk.
For a health system, effective management of business associates goes beyond signing a BAA. Teams maintain an inventory of every vendor with PHI access, classify risk by the amount and sensitivity of data and the type of access, review security evidence before contracting and periodically afterward, and specify incident notification timelines, audit rights, data return or destruction on termination, and subcontractor controls. They also plan for the failure of a critical vendor, including downtime and exit strategies. New technology raises new questions, such as whether an AI documentation vendor may use PHI to train its models, which the contract should address explicitly.
Common business associate problems:
- No complete inventory of vendors with PHI access
- BAAs signed once and never reviewed
- Vendor risk judged only by questionnaires
- Subcontractors the covered entity does not know about
- Unclear incident reporting timelines
- Data retained or reused by the vendor after the contract ends
What supports sound BA management:
- A maintained inventory with risk tiers
- Standard BAA templates reviewed by privacy and legal teams
- Security assessments before and during the relationship
- Defined breach notification and cooperation terms
- Rules on data use, AI training, retention, and return
- Exit and continuity plans for critical vendors
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses rarely sign vendor contracts, but they work with business associates every day.
At the Bedside
A nurse may call a vendor’s support line, use a hosted application, or send a fax to an outside service. Sharing PHI with a vendor outside an approved process can create a privacy incident. When in doubt about whether a vendor is approved, nurses check with the unit’s privacy resource before sending information or screenshots.
In Clinical Workflow
Nurse managers learn which outside services handle patient information on their units, such as interpreter services, transcription, and remote monitoring. Nurses in home health and long-term care often coordinate with contracted agencies, where it matters whether the arrangement is for treatment or for services that require a BAA.
Nurse informaticists take part in vendor selection and implementation, define what data a vendor needs, and raise concerns about excessive access. They also help evaluate whether new tools, such as ambient documentation or analytics services, are using PHI in ways staff and patients would expect.
In EHR Implementation (Go-Live Perspective)
An Epic Go-Live involves many vendors with access to systems and data, including hosting, device, interface, and support partners. Privacy and security staff confirm BAAs and access controls before go-live. At-the-elbow support analysts and command center staff use approved channels and avoid sharing screenshots containing PHI in unapproved tools.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Business associates appear in privacy, vendor management, and compliance questions:
| CAHIMS Domain | How Business Associates Appear |
|---|---|
| Healthcare & Technology Environments | HIPAA, HITECH, Omnibus Rule, enforcement |
| Clinical Informatics | Data use by vendors, AI and analytics services |
| Healthcare Information & Systems Management | Hosting, access control, vendor security assessment |
| Management & Leadership | Contracting, risk management, oversight, incident response |
Key Terms to Know Alongside Business Associate
- Business Associate Agreement (BAA) — contract that sets a BA’s obligations for handling PHI
- Covered Entity — health plan, clearinghouse, or provider that conducts standard transactions
- Subcontractor — entity that handles PHI on behalf of a business associate
- Omnibus Rule — 2013 HIPAA rule extending direct liability to business associates
- Breach of Unsecured PHI — impermissible use or disclosure that compromises PHI
- Third-Party Risk Management — program to assess and monitor vendor risk
HIMSS Organizational Position
HIMSS supports privacy and security in health information through its public policy work, Healthcare Cybersecurity Community, and research. Members can find related resources through the HIMSS Healthcare Cybersecurity Community page.
🔗 Explore Further: External References
- eCFR — 45 CFR 160.103, Definitions https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
- eCFR — 45 CFR 164.504, Uses and Disclosures: Organizational Requirements https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504
- eCFR — 45 CFR 164.308, Administrative Safeguards https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
- Ignatovski (2026), JMIR Medical Informatics — Business Associates’ Involvement in US Health Care Data Breaches: Longitudinal Analysis https://pubmed.ncbi.nlm.nih.gov/42837534/
- Yaraghi and Gopal (2018), Milbank Quarterly — The Role of HIPAA Omnibus Rules in Reducing the Frequency of Medical Data Breaches: Insights From an Empirical Study https://pubmed.ncbi.nlm.nih.gov/29504206/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply