Business associate
CIPP/US glossary · Last reviewed: · By Victor Humenhuk (CIPP/US certified)
Business associate - Any person or organization, other than a covered entity's workforce member, that performs services for or on behalf of a covered entity involving the use or disclosure of PHI.
In the CIPP/US body of knowledge, Business associate comes up under Chapter 4: Information Management and Privacy Risk Management; Chapter 8: Medical Privacy.
Business associate in context
- A ==controller== determines purposes and means; a ==processor== processes on the controller's behalf - mirrored by HIPAA's ==business associate== and GLBA's ==service provider==. (Data Accountability - Controllers, Processors, and Encryption)
- ==PHI== is individually identifiable health information held by a covered entity or business associate relating to a person's health, care, or payment. (PHI and ePHI Defined)
- A ==business associate== performs services for a covered entity involving the use or disclosure of PHI. (Business Associates and BAAs)
Where Business associate is covered in the CIPP/US study notes
Related terms
- Controller
- Processor
- Service provider
- Retention policy
- Business associate agreement (BAA)
Test yourself on Business associate
Recognising a definition is not the same as applying it in an exam scenario. Work through the free CIPP/US practice questions, or read the full CIPP/US study guide - every study note is free.