It depends on control. The rule defines workforce as employees, volunteers, trainees and other persons whose conduct in the performance of work is under the direct control of the entity, whether or not paid. An outside firm that performs a function with its own staff and processes is more likely a business associate.
What the definitions say
Workforce covers employees, volunteers, trainees and other persons under the direct control of a covered entity or business associate, whether or not they are paid. A business associate, by contrast, performs a function or service for the covered entity, other than as a member of its workforce, that involves creating, receiving, maintaining or transmitting PHI or receiving a disclosure of it.
The words other than in the capacity of a member of the workforce matter. They draw the line.
Factors to weigh
| Factor | Points toward workforce | Points toward business associate |
|---|---|---|
| Who directs the daily work | You do | The contractor does |
| Tools and accounts | Yours, provisioned by you | Theirs |
| Where work happens | Your systems and policies | Their environment |
| Who employs the person | You, or a close arrangement | A separate company |
| Substitution | You assign the person | The firm chooses who works |
No single factor decides. Counsel can help with grey cases, and a signed agreement is cheap insurance if you are unsure.
Why it matters for security
Workforce members are covered by your policies: security awareness and training, sanction policies, access authorisation and termination procedures. A business associate brings its own policies and a contract. Mixing the two causes gaps. For example, a long term contractor with admin rights who never took your training, and whose offboarding no one owns.
Practical steps
- List every non employee with access to PHI systems.
- For each, record whether you treat them as workforce or as a vendor and why.
- If workforce, apply training, unique user IDs and termination procedures.
- If vendor, sign an agreement and add them to the register.
- Review the list when contracts renew.
Several workforce security items in the rule, such as authorisation, clearance and termination procedures, are addressable, which means you assess and document the approach you take.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
Does a signed BAA turn a contractor into a business associate?
The definition turns on function and control, not the label. Use the agreement to document the relationship you actually have.
Do contractors need security training?
If they are workforce, the training standard applies to them. Check with counsel for the rest.
Sources
Last reviewed: 19 October 2026.
