SESK: Stuff Everyone Should Know · sesk.info/hipaa-ba-subcontractor
A business associate hires a subcontractor that will handle PHI. Who must get the subcontractor's written assurances?
The business associate.
- The covered entity
- The patient
- The business associate ✔
Why: The business associate must get satisfactory assurances from its subcontractor that PHI will be safeguarded. The covered entity doesn't have to sign with its business associate's subcontractors.
Huh, didn't know that: A subcontractor that handles PHI for a business associate is itself a business associate.
Why did the pencil go to the meeting? To make a point.
Like this card?
References
Answer: The business associate. The business associate must get satisfactory assurances from its subcontractor that PHI will be safeguarded. The covered entity doesn't have to sign with its business associate's subcontractors.
- 45 CFR 164.502 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor.
Checked 2026-10-10. - 45 CFR 160.103 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.
Checked 2026-10-10.
Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.
More stuff everyone should know
Work SkillsA clinic hires an outside company to handle its insurance billing using patient records. What is that company under HIPAA?Work SkillsA clinic sends records to a specialist who will treat the patient. Is the specialist the clinic's business associate?Work SkillsWhen a business associate contract ends, what must happen to the PHI the business associate still holds, if feasible?
That's stuff everyone should know.