HIPAA compliance consulting for business associates.
A business associate (BA) under HIPAA is any person or entity that performs functions or activities on behalf of a covered entity involving the use or disclosure of protected health information (PHI), as defined in 45 CFR 160.103.
Business associates handle patient data on behalf of covered entities. Under the HITECH Act and 45 CFR Part 164, you have direct HIPAA duties, including obligations under the Privacy Rule, Security Rule, and Breach Notification Rule. If you provide IT, billing, cloud hosting, legal help, marketing, or any service that touches PHI, you need your own compliance program. We help you build one that works in real audits and client reviews.
Yes.OCR can investigate and fine you, not just your client.
The HITECH Act (2009) extended direct HIPAA liability to business associates. Before HITECH, only covered entities faced enforcement; now BAs are independently subject to OCR investigations and civil monetary penalties.
Six areas, each tied to a duty you carry directly.
Each area below maps to a specific regulatory obligation that business associates carry directly under 45 CFR Part 164. These are not optional. They are the compliance foundations OCR examines when investigating a BA.
Why business associates need their own HIPAA program.
Before the HITECH Act, only covered entities faced HIPAA enforcement. That changed. Now BAs face direct liability under the Privacy Rule, Security Rule, and Breach Notification Rule.
45 CFR 164.502(e) requires covered entities to obtain satisfactory assurances, in the form of a Business Associate Agreement, before disclosing PHI. But the BA must actually be able to deliver on those assurances. 164.308(b)(1) directly obligates BAs to implement the applicable Security Rule requirements. OCR can investigate and fine you, not just your client.
Big clients now demand compliance proof before they sign contracts.
Hospitals and health plans send security surveys. They ask for risk analysis documents. They want to see that your BAA duties under 164.504(e) have real support. Without this, you lose deals.
Most BAs try hard on compliance but lack structure.
We have worked with dozens of BAs in healthcare IT, SaaS, billing, and consulting. These gaps come up most often.
Incomplete asset inventories
Cloud services and vendors are missing from risk analysis scope.
No scheduled access reviews
Access reviews with no proof trail, a gap under workforce access management.
Insufficient incident response plans
Plans that would fail an OCR review of the security incident procedures requirement.
Template-based policies
Policies that do not reflect actual operations, failing the documentation standard.
Insufficient subcontractor oversight
Vendors that also touch PHI on the BA's behalf without proper assurances.
Outdated encryption controls
Weak protection for stored and transmitted data, an addressable specification.
We close these gaps with solid documents tied to your real work, not just checkboxes.
Six stages, each tied to 45 CFR Part 164.
We start by mapping your setup, vendors, and contract duties. Then we work in stages, each tied to specific regulatory requirements under 45 CFR Part 164.
- 01
Discovery
We map where PHI lives, your hosting, vendors, and current documents, establishing scope for the risk analysis.
OutputScope for the risk analysis. - 02
Assessment
We run a security risk analysis and gap analysis across your BA duties under 45 CFR Part 164, including Privacy Rule obligations and organizational requirements.
- 03
Fix plan
We rank findings by risk and effort. We assign owners and set deadlines, prioritizing required specifications over addressable ones.
- 04
Document build
We write policies and procedures that match your real work and satisfy the documentation standard.
- 05
Training
Role-based staff training with tracked completion.
- 06
Ongoing support
Regular reviews required by the periodic evaluation standard so your program stays current.
The result: a program you can run, maintain, and show in audits or client reviews.
What BA clients get out of a structured program.
Business associates who complete a structured HIPAA program typically see measurable improvements in contract readiness and audit defensibility. These are the outcomes we see most consistently.
The sections OCR references when it audits a BA.
The following HIPAA standards apply directly to business associates under 45 CFR Part 164.
45 CFR 164.502(e)
Covered entities may only disclose PHI to a BA if a compliant Business Associate Agreement is in place. BAs must be able to operationalize the privacy protections they agree to.
45 CFR 164.308(b)(1)
Business associates are directly required to implement the applicable administrative safeguards of the Security Rule, including risk analysis, workforce training, and incident response.
45 CFR 164.314
Business associates must have a written BAA with each covered entity client and must obtain satisfactory assurances from any subcontractor that handles PHI on the BA's behalf.
45 CFR 164.410
Business associates must notify affected covered entities of discovered breaches without unreasonable delay and no later than 60 days after discovery. Required notification content is specified in 164.410(c).
45 CFR 164.504(e)
Specifies what a Business Associate Agreement must contain, including permitted uses and disclosures, BA obligations to report breaches, and requirements for return or destruction of PHI at contract termination.
45 CFR 164.316
Business associates must implement reasonable and appropriate policies and procedures, maintain written documentation of those policies, and retain documentation for six years from creation or last effective date.
Flat-rate plans for business associates.
Two plans, six ways to pay. No per-user fees. Pick the level of help you want from Chuck.
- The platform on its own
- SRA, gap analysis, remediation plans
- Policy templates and staff training
- Vendor and BAA management
- Everything in Self-Guided
- 4 hours a month of 1:1 implementation calls with Chuck
- Incident response guidance
- CMS audit response support
One payment, two full years of coverage.
Secure checkout by Stripe. Your payment details go straight to Stripe and never touch our servers.
Chuck Weiselberg, C.H.P.
Certified HIPAA Professional (C.H.P.). Zero client fines. Zero failed audits.
“One Guy Consulting is super easy to work with. I actually look forward to my implementation meetings for HIPAA.”
Samantha M.
Business associate compliance, answered.
Do BAs really need their own HIPAA program?+
What happens if a BA has a breach?+
Can OCR fine a BA directly?+
What is the difference between a BA and a subcontractor?+
Need HIPAA consulting for business associates?
We work with BAs across healthcare IT, billing, SaaS, and professional services. Two flat-rate plans, no per-user fees.