{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/us/agent/hipaa/associates",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-08-25",
    "proof": "sha256:a4321d807ede1507af206a317e55bb6a63ae6eb292ad597f1e8f71300e3f82d1",
    "jurisdiction": "eu"
  },
  "layer": "us-agent-section",
  "agent": "hipaa",
  "slug": "associates",
  "title": "Business associate contracts",
  "reference": "45 CFR 164.314",
  "scope": "Written terms with every party that handles the data on your behalf.",
  "rule": "hipaa-security-rule",
  "identifier": "45 CFR Part 164, Subpart C",
  "jurisdiction_scope": [
    "federal"
  ],
  "risk_dimensions": [
    "privacy",
    "security",
    "operational"
  ],
  "tier": 1,
  "deterministic": true,
  "llm_used": false,
  "verdict_kind": "machine-classification",
  "official_source": "https://www.ecfr.gov/current/title-45/section-164.314",
  "register_source": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C",
  "cited_by": [
    {
      "ruleId": "hipaa-breach",
      "code": "hipaa-breach",
      "title": "Anmälningsskyldighet vid incident gäller",
      "titleEn": "The breach notification requirement applies",
      "verdict": "risk",
      "audit": "KRAV_GÄLLER",
      "obligation": "45 CFR 164.408 kräver anmälan till Health and Human Services utan oskäligt dröjsmål och senast 60 dagar efter upptäckt när minst 500 personer berörs. Underrättelse till den enskilde regleras i 45 CFR 164.404.",
      "obligationEn": "45 CFR 164.408 requires notice to Health and Human Services without unreasonable delay and no later than 60 days after discovery when at least 500 individuals are affected. Notice to the individual is governed by 45 CFR 164.404."
    },
    {
      "ruleId": "hipaa-ba",
      "code": "hipaa-ba-missing",
      "title": "Business associate-avtal saknas",
      "titleEn": "The business associate agreement is absent",
      "verdict": "förbjudet",
      "audit": "KRAV_GÄLLER",
      "obligation": "45 CFR 164.308(b)(1) kräver ett skriftligt avtal innan en business associate skapar, tar emot, behåller eller överför elektronisk skyddad hälsoinformation för en täckt enhets räkning. Innehållet regleras i 45 CFR 164.314(a).",
      "obligationEn": "45 CFR 164.308(b)(1) requires a written contract before a business associate creates, receives, maintains or transmits electronic protected health information on behalf of a covered entity. The content is governed by 45 CFR 164.314(a)."
    }
  ],
  "checked_at": "2026-08-15",
  "canonical": "https://legal.exploreworldai.com/us/agent/hipaa/associates",
  "agent_canonical": "https://legal.exploreworldai.com/us/agent/hipaa",
  "hash": "sha256:a4321d807ede1507af206a317e55bb6a63ae6eb292ad597f1e8f71300e3f82d1",
  "citation": "45 CFR Part 164, Subpart C, HIPAA, Skyddad hälsoinformation. ExploreWorld Legal, https://legal.exploreworldai.com/us/agent/hipaa (hämtad 2026-08-15, bevis sha256:035c1dfa4597564c, bygge legal-2026-08-25).",
  "disclaimer": "Källhänvisning med officiell identifierare. Ingen juridisk rådgivning och inget efterlevnadsbeslut.",
  "version": "legal-2026-08-25",
  "expires": "2026-08-31T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-08-25+legal-2026-08-25+2026-08-25T10:00:00",
    "content_hash": "sha256:a4321d807ede1507af206a317e55bb6a63ae6eb292ad597f1e8f71300e3f82d1",
    "revalidate_after": "2026-08-30T08:47:07.775Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; live-fetch-per-answer; attribution-required; no-derived-index",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "usageInfo": "https://legal.exploreworldai.com/citering"
}