Compliance & Legal
Conduit Exception
A narrow HIPAA exception for services that only transmit PHI without storing it.
The Conduit Exception is a narrow HIPAA carve-out for services that merely transport PHI from one point to another, like a postal carrier or an internet service provider, without ever storing or accessing it. Such pure conduits are not business associates and do not need a BAA.
The exception does not apply to managed hosting providers, which store patient data and therefore must sign a BAA. See our HIPAA hosting cost guide.