Conduit Exception
Also known as: HIPAA conduit exception
A narrow HIPAA exception for transmission-only services, like ISPs, that hold PHI only briefly in transit.
The Conduit Exception is a narrow HIPAA carve-out for services that only transmit PHI, like a postal carrier or an internet service provider. A conduit may hold data briefly while it is in transit. It may see the data only on a random or infrequent basis, such as checking that a transmission arrived. Under the HIPAA conduit exception, such pure conduits are not business associates and do not need a BAA. Our map of practice systems shows which of your vendors need a BAA.
HHS explained the limit in its 2013 Omnibus Rule preamble (78 FR 5571 to 5572): the test is transient versus persistent access. An entity that maintains PHI for you is a business associate, not a conduit, even if it never views the data. HHS cloud guidance says a cloud provider that stores PHI is generally not a conduit, even if the data is encrypted and it lacks the key. A provider that both transmits and stores PHI is a business associate for both services.
The exception does not apply to managed hosting providers, which store patient data. That makes a host a business associate, so you need a signed BAA before it holds PHI. Our guide to the HIPAA business associate agreement covers what that contract must say. We sign our BAA within 24 hours of signup, before patient data moves, and it covers the servers and services we run. For what hosting with a BAA costs, see our HIPAA hosting cost guide.