HIPAA Privacy Rule: a business associate's permitted uses (45 CFR 164.502(a)(3))
A vendor holding a health client's data may de-identify it for its own purposes only if its business associate agreement permits that.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“A business associate may use or disclose protected health information only as permitted or required by its business associate contract or other arrangement pursuant to § 164.504(e) or as required by law.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide