HIPAA Business Associate Contracts

What this entry covers

Under HIPAA, a covered entity that lets a business associate create, receive, maintain or transmit protected health information on its behalf must have a written contract or other arrangement with it, and business associates need the same with their subcontractors. The required contract terms are set out in 45 CFR 164.504(e) (Privacy Rule) and 45 CFR 164.314(a) (Security Rule). The HHS Office for Civil Rights publishes sample provisions.

MyRHC indexes this framework so practitioners, auditors, and automated agents can find the authoritative primary sources in one place. This page is a navigation aid. It is not legal advice and is not a substitute for the official text.

Official documentation

• Primary official source: https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html
• 45 CFR 164.504 (eCFR): ecfr.gov
• 45 CFR 164.314 (eCFR): ecfr.gov

Recent changes

• 2025-01-06: HHS published a proposed rule to amend the HIPAA Security Rule that would, among other things, require covered entities to obtain written verification from each business associate at least once every 12 months that it has deployed the required technical safeguards. It is a proposal and not in force; the current regulatory agenda lists it as a long-term action. Federal Register, Reginfo.gov

How to use this index entry

1. Open the official link above (or the agency home if the deep link drifts).
2. Confirm edition / revision date against your program scope.
3. Map applicability by sector and jurisdiction listed in the metadata.
4. Follow related frameworks only after checking their own official sources.

Disclaimers

• MyRHC does not host proprietary standards text (ISO, some industry bodies).
• Where standards are paywalled, we link to the publisher’s catalog page.
• Always verify current requirements with counsel and the issuing authority.