The business associate definition covers a person or entity that creates, receives, maintains or transmits protected health information on behalf of a covered entity. Storage is maintaining. Encryption is a safeguard, and the definition text we reviewed does not carve out encrypted data. HHS cloud guidance addresses edge cases, so read it and ask counsel.
What the text says
The definition of business associate in the regulation includes maintaining PHI on behalf of the covered entity, and it includes subcontractors that do the same for a business associate. The paragraph listing who is not a business associate does not include providers of encrypted storage. Encryption appears elsewhere in the rule as an addressable safeguard under access control and transmission security.
Why the confusion exists
Some providers argue they hold just ciphertext and never see the content. HHS publishes cloud computing guidance for regulated entities. We could not retrieve that page while preparing this post, so we do not summarise it here. Read the current guidance directly instead of relying on a summary.
A decision aid
| Question | If yes | If no |
|---|---|---|
| Does the provider store or process PHI for us? | Likely a business associate, so sign an agreement | Move to the next question |
| Does the provider hold keys that can decrypt the data? | Stronger case for business associate status | Still ask counsel |
| Would the service stop if we removed our data? | It maintains the data on our behalf | Reassess the role |
| Does the provider use the data for its own purposes? | Raises further questions | Document why not |
Do not let this table decide. It organises the facts you take to counsel.
Practical position for buyers
Unclear cases cost less to resolve by signing an agreement than by arguing later. If a provider refuses to sign one, ask why, document the answer, and consider whether PHI should be there at all.
Keys and control
Who holds the keys matters for risk even where the legal answer is settled. Customer managed keys, rotation, and the ability to revoke access are reasonable questions in any review.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
Does encryption remove the need for a BAA?
The definition text we reviewed has no such exception. Ask counsel and read the current HHS cloud guidance.
Is a provider that just transmits data a business associate?
Transmitting is in the definition. Whether a narrow exception applies to a pure transmission service is a question for counsel and current HHS guidance.
Sources
Last reviewed: 19 October 2026.
