AhaBulb: Stuff Everyone Should Know · ahabulb.com/hipaa-ba-subcontractor
A business associate hires a subcontractor that will handle PHI. Who must get the subcontractor's written assurances?
The business associate.
- The covered entity
- The patient
- The business associate ✔
Why: The business associate must get satisfactory assurances from its subcontractor that PHI will be safeguarded. The covered entity doesn't have to sign with its business associate's subcontractors.
Huh, didn't know that: A subcontractor that handles PHI for a business associate is itself a business associate.
Why did the pencil go to the meeting? To make a point.
Like this card?
References
Answer: The business associate. The business associate must get satisfactory assurances from its subcontractor that PHI will be safeguarded. The covered entity doesn't have to sign with its business associate's subcontractors.
- 45 CFR 164.502 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor.
Checked 2026-10-10. - 45 CFR 160.103 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103
A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.
Checked 2026-10-10.
Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.
More stuff everyone should know
Healthcare Privacy (HIPAA)Does HIPAA protect patient information that is spoken out loud, or only paper and computer records?Healthcare Privacy (HIPAA)A hospital's HR office keeps Dana's pre-hire physical in Dana's personnel file, as the employer. Is that file PHI?Healthcare Privacy (HIPAA)For how long after a person dies must a covered entity keep protecting that person's health information?
That's stuff everyone should know.