SESK: Stuff Everyone Should Know · sesk.info/hipaa-baa-written-contract
What must a clinic have before letting a cloud company store its patient records?
A business associate agreement (written contract).
- Each patient's signed authorization
- A written business associate agreement ✔
- Nothing, storage isn't a disclosure
Why: A covered entity may let a business associate maintain PHI only after getting satisfactory assurance it will safeguard the information. That assurance must be in a written contract or agreement.
Huh, didn't know that: The contract must spell out how the business associate is allowed to use and disclose the PHI.
What did the stamp say to the envelope? I'm stuck on you.
Like this card?
References
Answer: A written business associate agreement. A covered entity may let a business associate maintain PHI only after getting satisfactory assurance it will safeguard the information. That assurance must be in a written contract or agreement.
- 45 CFR 164.502 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
must be documented through a written contract or other written agreement or arrangement with the business associate
Checked 2026-10-10. - 45 CFR 164.504 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504
Establish the permitted and required uses and disclosures of protected health information by the business associate.
Checked 2026-10-10.
Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.
More stuff everyone should know
Work SkillsA clinic hires an outside company to handle its insurance billing using patient records. What is that company under HIPAA?Work SkillsA clinic sends records to a specialist who will treat the patient. Is the specialist the clinic's business associate?Work SkillsA business associate hires a subcontractor that will handle PHI. Who must get the subcontractor's written assurances?
That's stuff everyone should know.