AhaBulbStuff Everyone Should Know
AhaBulb: Stuff Everyone Should Know · ahabulb.com/hipaa-baa-written-contract

What must a clinic have before letting a cloud company store its patient records?

A business associate agreement (written contract).

Start playing free

  1. Each patient's signed authorization
  2. A written business associate agreement ✔
  3. Nothing, storage isn't a disclosure

Why: A covered entity may let a business associate maintain PHI only after getting satisfactory assurance it will safeguard the information. That assurance must be in a written contract or agreement.

Huh, didn't know that: The contract must spell out how the business associate is allowed to use and disclose the PHI.

The dad joke
What did the stamp say to the envelope? I'm stuck on you.
Like this card?
Play the game

References

Answer: A written business associate agreement. A covered entity may let a business associate maintain PHI only after getting satisfactory assurance it will safeguard the information. That assurance must be in a written contract or agreement.

  1. 45 CFR 164.502 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502
    must be documented through a written contract or other written agreement or arrangement with the business associate
    Checked 2026-10-10.
  2. 45 CFR 164.504 (eCFR) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504
    Establish the permitted and required uses and disclosures of protected health information by the business associate.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Healthcare Privacy (HIPAA)A clinic hires an outside company to handle its insurance billing using patient records. What is that company under HIPAA?Healthcare Privacy (HIPAA)Does HIPAA protect patient information that is spoken out loud, or only paper and computer records?Healthcare Privacy (HIPAA)A hospital's HR office keeps Dana's pre-hire physical in Dana's personnel file, as the employer. Is that file PHI?

That's stuff everyone should know.