HIPAA Privacy Rule: what a business associate contract must establish (45 CFR 164.504(e)(2)(i))
The business associate agreement is where any right to de-identify and reuse a client's data must be written; silence leaves the vendor without that right.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“A contract between the covered entity and a business associate must: (i) Establish the permitted and required uses and disclosures of protected health information by the business associate.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide