Compliance & Legal
Subcontractor (HIPAA)
A vendor a business associate hires to handle PHI, who must also sign a BAA.
Under HIPAA, a subcontractor is a person or company that a business associate engages to create, receive, maintain, or transmit protected health information (PHI) on its behalf.
The HIPAA Omnibus Rule extended direct liability down the entire chain: a subcontractor is itself treated as a business associate and must sign a Business Associate Agreement (BAA) with the vendor that hired it. This is why a compliant hosting provider must have BAAs in place with its own data-center and infrastructure suppliers. The downstream contract terms are in HIPAA business associate agreement.