HIPAA
Conduit Exception
A narrow HIPAA exception for services that only transmit PHI without storing it.
The Conduit Exception is a narrow HIPAA carve-out for services that merely transport PHI from one point to another — like a postal carrier or an internet service provider — without ever storing or accessing it. Such pure conduits are not business associates and do not need a BAA.
The exception does not apply to managed hosting providers, which store patient data and therefore must sign a BAA. See our HIPAA hosting cost guide.