Subcontractor (HIPAA)
Also known as: Business associate subcontractor
A vendor a business associate hires to handle PHI, who must also sign a BAA.
Under HIPAA, a subcontractor is a person or company that a business associate engages to create, receive, maintain, or transmit protected health information (PHI) on its behalf.
The HIPAA Omnibus Rule extended direct liability down the entire chain: a subcontractor is itself treated as a business associate and must sign a Business Associate Agreement (BAA) with the vendor that hired it. This is why a compliant hosting provider must have BAAs in place with its own data-center and infrastructure suppliers. The downstream contract terms are in HIPAA business associate agreement. The same chain extends to workflow automation: when a business associate's workflows send PHI to an LLM, email, or SMS vendor, that vendor is a subcontractor and needs a BAA too, as our n8n HIPAA compliant guide explains.