As defined by the Health Information Portability and Accountability Act (HIPAA), a business associate is any organization or person working in association with or providing services to a covered entity who handles or discloses Personal Health Information (PHI) or Personal Health Records (PHR).

Examples of business associates include accounting or consulting firms that work with covered entities, such as hospitals or doctors, or any number of other organizations that have or could have access to PHI or PHR.

Updates made to the HIPAA regulation by the HITECH Act require business associates to comply with HIPAA mandates regarding the handling and use of PHI. As of February 18, 2010, the Department of Health and Human Services can audit business associates for HIPAA compliance.

28 Jun 2010