A business associate is a separate entity that provides services to or on behalf of the covered entity that may involve the use and disclosure of PHI.
A business associate agreement (BAA) between covered entities and their business associates must be in place. This contract defines the processes that will be implemented and outlines the permissible uses and disclosures of PHI by the business associate. A business associate may use or disclose PHI only as permitted or required by the BAA or as required by law. If the business associate has a subcontractor, that subcontractor must also have and adhere to a BAA with the covered entity.
