A software vendor is a HIPAA business associate when it creates, receives, maintains or transmits protected health information on behalf of a covered entity or another business associate, for a function the HIPAA rules regulate. Hosting, data analysis and billing tools usually qualify. Selling software that never touches PHI usually does not.
The regulatory test
The definition is in 45 CFR 160.103. A business associate is a person who, on behalf of a covered entity and outside its workforce, creates, receives, maintains or transmits PHI for a regulated function or activity. The examples include claims processing, data analysis, utilization review, quality assurance, patient safety activities, billing, benefit management, practice management and repricing.
The second limb covers certain services: legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial services, where providing the service involves disclosure of PHI to the provider.
The definition also names some groups outright. Health information organizations, e-prescribing gateways and other data transmission providers that need routine access to PHI are included. So are people who offer a personal health record on behalf of a covered entity, and subcontractors that handle PHI for a business associate.
The word that matters: maintains
Teams often assume that if they never read the data they are out. The text says "maintains" as well as "creates, receives and transmits". A cloud product that stores encrypted PHI for a customer is maintaining it, even if the vendor cannot decrypt anything. Whether a particular no-view arrangement changes the answer is a question for counsel and for current HHS guidance, so check it for your model rather than assuming.
Quick decision guide
Ask these in order:
- Does the customer you sell to qualify as a covered entity or business associate?
- Will PHI, in any form, be stored on, pass through or be visible to your systems or staff?
- Is that for a function done on the customer's behalf, rather than for the vendor's own purposes?
- Does your support team ever get access to production data?
A yes on 1 to 3 points strongly toward business associate status. A yes on 4 alone is a signal to look harder at your access model.
What changes if you are one
- You must sign a business associate agreement with each covered entity customer, and with your own subcontractors that handle PHI. See what a BAA must contain.
- The Security Rule applies to you directly, including risk analysis and the technical safeguards.
- You owe breach notification to the covered entity, with a 60 day outer limit.
- Subcontractors that handle PHI for you are business associates too.
Common gray areas
Consumer apps that people use on their own, without a covered entity directing them, are a different question from tools a provider deploys for patients. A personal health record offered on behalf of a covered entity falls in scope. Check how your product is actually contracted and used.
Another gray area is a vendor that only receives de-identified data. Data that meets the de-identification standard is not PHI, so the business associate trigger does not apply to it. See Safe Harbor vs Expert Determination.
Quick check
Does encrypting data so we cannot read it remove business associate status?
The definition includes entities that maintain PHI, so it does not clearly remove it. Get legal advice and check current HHS guidance for your architecture.
Is a subcontractor of a business associate covered?
Yes. The definition includes a subcontractor that creates, receives, maintains or transmits PHI on behalf of the business associate.
Sources
Last reviewed: 19 October 2026.
