A common misconception in healthcare compliance is that HIPAA’s obligations flow primarily from covered entities outward to vendors through Business Associate Agreements. Under this view, a business associate’s compliance obligations are essentially contractual: do what the BAA says, and HIPAA is satisfied.

That view is incorrect, and the gap between that understanding and the actual regulatory framework is significant. Since the HITECH Act’s implementing regulations took effect in 2013, business associates have been directly liable under HIPAA regardless of what their contracts say. A business associate that lacks a Security Rule compliance program does not merely breach its BAA obligations. It violates federal law, and OCR can pursue enforcement directly against it.

This article explains what HIPAA directly requires of business associates, where the compliance obligations fall, and what the practical implications are for technology companies, service providers, and other vendors working in the healthcare space.

Direct Liability Under the HITECH Act

Prior to the HITECH Act and its implementing regulations, business associates’ HIPAA obligations existed primarily through their contracts with covered entities. Enforcement against business associates for HIPAA violations was limited in practice.

The HITECH Act changed that framework fundamentally. Since September 2013, business associates have been directly subject to the HIPAA Security Rule’s administrative, physical, and technical safeguard requirements. They have been directly subject to the Breach Notification Rule’s obligation to notify covered entities of breaches. And certain Privacy Rule provisions apply directly to them as well, particularly the prohibition on using or disclosing PHI in ways not permitted or required by the Privacy Rule.

OCR has pursued enforcement actions directly against business associates and has made clear in public guidance that the regulatory obligations are not conditional on what the BAA says. A business associate that never signed a BAA still has direct HIPAA compliance obligations. A business associate whose BAA does not explicitly address the Security Rule’s requirements is still required to comply with those requirements. The regulatory obligation exists independent of the contract.

Security Rule Obligations for Business Associates

Business associates are directly required to comply with the HIPAA Security Rule’s safeguard requirements for any electronic protected health information they create, receive, maintain, or transmit on behalf of a covered entity. This means the full scope of Security Rule obligations applies, not a subset.

Security Risk Analysis. Business associates must conduct a Security Risk Analysis that covers the full scope of their ePHI environment. Many technology companies and SaaS vendors that work with healthcare clients have never completed a risk analysis, operating under the assumption that the covered entity’s compliance program covers both parties. It does not. The business associate’s own risk analysis is a separate, independent requirement.

Written Security Policies. Business associates must implement documented administrative safeguards covering information security, access control, workforce security, incident response, and contingency planning. The same core policy requirements that apply to covered entities apply to business associates.

Physical and Technical Safeguards. Business associates must implement physical access controls, workstation security, and device and media controls for systems where ePHI is stored or processed. On the technical side, access controls, audit logging, integrity controls, and transmission security requirements all apply.

Workforce Training. Business associates must implement a workforce training program covering security awareness and, as applicable, specific security procedures relevant to each workforce member’s role.

Breach Notification Obligations for Business Associates

When a business associate discovers a breach of unsecured PHI, it has a direct obligation under 45 CFR 164.410 to notify the covered entity without unreasonable delay and no later than 60 days from the date of discovery. The business associate must provide the covered entity with the identity of each individual whose PHI was involved in the breach, if known, and any other information reasonably available at the time of notification.

The 60-day maximum is a regulatory floor. Business associate agreements typically specify a shorter contractual deadline, often 10 to 30 days. Business associates that fail to notify covered entities within the contractually specified window are in breach of the BAA. Business associates that fail to notify within 60 days are in direct violation of HIPAA, regardless of the BAA terms.

Business associates are also responsible for conducting their own four-factor risk assessment when an incident occurs to determine whether it constitutes a breach requiring notification. The fact that an incident occurred within the business associate’s systems does not automatically mean the business associate notifies the covered entity for every security event. The risk assessment process determines whether the incident rises to the level of a reportable breach.

Subcontractor Obligations

When a business associate uses a subcontractor that creates, receives, maintains, or transmits PHI on behalf of the business associate, the subcontractor is itself a business associate under HIPAA. The business associate must enter into a Business Associate Agreement with the subcontractor, and the subcontractor has the same direct HIPAA obligations that the business associate has.

This chain of obligations means that cloud service providers, data processors, and infrastructure vendors used by healthcare technology companies may themselves be business associates with direct HIPAA compliance obligations, even if they have no direct relationship with any covered entity. A SaaS vendor that stores ePHI on AWS, Azure, or Google Cloud needs BAAs with those cloud providers if the cloud providers have access to unencrypted ePHI.

What Covered Entities Should Verify About Their Business Associates

From the covered entity’s perspective, having a signed BAA with each business associate does not transfer HIPAA liability to the business associate or eliminate the covered entity’s own compliance obligations. What it does is establish contractual accountability and confirm that the business associate has acknowledged its HIPAA obligations.

Covered entities should verify that their business associates have adequate security programs in place. The BAA typically requires business associates to report security incidents and breaches to the covered entity, to comply with the HIPAA Security Rule, and to ensure that subcontractors enter into equivalent agreements. Covered entities that conduct periodic vendor security assessments or require attestations of compliance are in a stronger position when OCR investigates a breach that originated with a business associate.