What Is a Business Associate Agreement (BAA)? HIPAA Guide (2026)
A business associate agreement (BAA) is a written contract that a covered entity must execute with any outside vendor before sharing protected health information (PHI). Federal regulations at (e) require the agreement and specify the exact provisions it must contain.
What Is a Business Associate Agreement?
A Business Associate Agreement (BAA) is a legally binding written contract between a HIPAA-covered entity and a business associate. The agreement establishes how the business associate may use, disclose, and safeguard protected health information (PHI) that it receives from or creates on behalf of the covered entity.
HIPAA regulations at 45 CFR 164.502(e) prohibit covered entities from disclosing PHI to a business associate unless the covered entity obtains satisfactory assurances that the business associate will appropriately safeguard the information. Those assurances take the form of a BAA that meets the requirements set out in 45 CFR 164.504(e).
Without a valid BAA in place, any disclosure of PHI to an outside vendor constitutes a HIPAA Privacy Rule violation, regardless of whether the vendor actually mishandles the data.
Who Qualifies as a Business Associate?
Under HIPAA, a business associate is any person or entity (other than a member of the covered entity's own workforce) that performs functions or activities on behalf of a covered entity involving the creation, receipt, maintenance, or transmission of PHI. The 2013 Omnibus Rule expanded this definition to include subcontractors of business associates who handle PHI.
Common Examples of Business Associates
The U.S. Department of Health and Human Services (HHS) identifies several categories of entities that typically qualify as business associates:
- IT service providers that store, process, or transmit electronic PHI (ePHI) on their servers
- Cloud service providers (CSPs) that host applications or data containing ePHI, even if the data is encrypted and the CSP holds no decryption key
- Medical billing and coding companies that process claims containing patient information
- Claims processing and clearinghouse services that handle PHI during payment transactions
- Practice management software vendors that access patient data during troubleshooting or maintenance
- Accounting firms that receive financial records containing PHI for tax preparation or auditing
- Law firms that access PHI while providing legal services to a covered entity
- Shredding and document destruction companies that handle physical records containing PHI
- Data analytics firms that perform quality assurance, utilization review, or population health studies using PHI
Who Is Not a Business Associate?
Certain entities fall outside the business associate definition. A covered entity's own employees are part of its workforce and are not business associates. Providers who treat patients and receive PHI for treatment purposes are also excluded. Conduit entities, such as the U.S. Postal Service or internet service providers that merely transport data without routine access to it, do not qualify as business associates under the HHS guidance.
What a BAA Must Contain Under Federal Law
The regulations at 45 CFR 164.504(e)(2) lay out specific provisions that every BAA must include. A contract missing any of these elements may be considered invalid, and an invalid BAA means the covered entity lacks the required satisfactory assurances to share PHI.
Required Provisions
Permitted and required uses and disclosures. The BAA must establish exactly what the business associate is allowed to do with PHI, and what uses or disclosures the covered entity requires. The business associate may not use or further disclose the information except as the contract permits or as required by law.
Appropriate safeguards. The business associate must agree to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI. This obligation incorporates compliance with the HIPAA Security Rule standards at 45 CFR Part 164, Subpart C.
Breach reporting. The contract must require the business associate to report any use or disclosure of PHI not authorized by the agreement, including any security incident or breach of unsecured PHI as defined in 45 CFR 164.402.
Subcontractor requirements. Under the Omnibus Rule, the BAA must require the business associate to ensure that any subcontractors who create, receive, maintain, or transmit PHI agree in writing to the same restrictions and conditions that apply to the business associate. This creates a chain of accountability that extends downstream from the covered entity.
Individual rights support. The business associate must agree to make PHI available to individuals who request access under 45 CFR 164.524, to support amendments to PHI under 45 CFR 164.526, and to provide an accounting of disclosures under 45 CFR 164.528.
Government access. The business associate must make its internal practices, books, and records relating to PHI available to the Secretary of HHS for compliance verification purposes.
Return or destruction of PHI. Upon termination of the contract, the business associate must return or destroy all PHI received from, or created or received on behalf of, the covered entity. If return or destruction is not feasible, the contract must extend protections to the retained PHI and limit further uses and disclosures.
Termination authority. The contract must authorize the covered entity to terminate the agreement if the covered entity determines that the business associate has violated a material term.
Optional Provisions
Under 45 CFR 164.504(e)(4), a BAA may also permit the business associate to use PHI for its own proper management and administration, or to carry out its legal responsibilities. If the BAA permits disclosure for these purposes, the recipient must provide reasonable assurances that the information will remain confidential and must report any breaches.
History: How BAA Requirements Evolved
HIPAA (1996)
The Health Insurance Portability and Accountability Act of 1996 first introduced the concept of business associates. The original Privacy Rule, finalized in 2000 and amended in 2002, required covered entities to obtain satisfactory assurances from business associates through written contracts. However, only covered entities faced direct liability for HIPAA violations. Business associates had contractual obligations but were not subject to direct regulatory enforcement by HHS.
HITECH Act (2009)
The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009, fundamentally changed the enforcement landscape. HITECH made business associates directly liable for compliance with certain provisions of the HIPAA Security Rule and certain requirements of the Privacy Rule. The Act also introduced the Breach Notification Rule, requiring business associates to notify covered entities of breaches of unsecured PHI.
HITECH strengthened penalties significantly. The Act created a four-tier penalty structure and raised maximum civil monetary penalties to $1.5 million per violation category per calendar year. It also authorized state attorneys general to bring civil actions on behalf of their residents for HIPAA violations.
Omnibus Rule (2013)
The HIPAA Omnibus Rule, published on January 25, 2013 and effective September 23, 2013, finalized the HITECH Act's provisions and further expanded business associate obligations. Key changes included:
- Direct liability. Business associates became directly subject to HIPAA Security Rule requirements and certain Privacy Rule provisions, with HHS able to investigate and penalize them independently of any covered entity.
- Subcontractor accountability. The definition of "business associate" was expanded to include subcontractors that create, receive, maintain, or transmit PHI on behalf of a business associate. Each subcontractor relationship requires its own BAA.
- Breach notification duties. Business associates received explicit obligations to investigate potential breaches and notify the covered entity within 60 days of discovery.
- Compliance deadline. All existing BAAs had to be updated to comply with the Omnibus Rule by September 22, 2014.
Consequences of Not Having a BAA
Civil Monetary Penalties
The HHS Office for Civil Rights (OCR) enforces HIPAA through a four-tier penalty structure, with amounts adjusted annually for inflation. As of 2026, penalties range from $145 per violation at the lowest tier (where the entity was unaware of the violation) to $2,190,294 per violation at the highest tier (willful neglect with no corrective action). Annual caps apply, with Tier 4 violations carrying the steepest aggregate exposure.
| Tier | Knowledge Level | Minimum per Violation | Maximum per Violation |
|---|---|---|---|
| 1 | Did not know | $145 | $73,011 |
| 2 | Reasonable cause | $1,461 | $73,011 |
| 3 | Willful neglect (corrected within 30 days) | $14,602 | $73,011 |
| 4 | Willful neglect (not corrected) | $73,011 | $2,190,294 |
Criminal Penalties
Criminal violations of HIPAA carry penalties under 42 U.S.C. 1320d-6. Knowingly obtaining or disclosing PHI in violation of HIPAA can result in fines up to $50,000 and imprisonment up to one year. If the offense involves false pretenses, penalties increase to $100,000 and up to five years. Offenses committed with intent to sell, transfer, or use PHI for commercial advantage, personal gain, or malicious harm carry fines up to $250,000 and imprisonment up to 10 years.
Corrective Action Plans
Most OCR settlements include a corrective action plan (CAP) in addition to financial penalties. A CAP typically requires the organization to revise policies and procedures, conduct workforce training, perform a comprehensive risk analysis, and submit to monitoring by OCR for one to three years.
Real Enforcement Actions Involving BAAs
Federal enforcement demonstrates that OCR treats missing or deficient BAAs as serious violations. Several notable settlements highlight the consequences.
North Memorial Health Care: $1.55 Million (2016)
North Memorial Health Care of Minneapolis agreed to pay $1.55 million and adopt a corrective action plan after OCR found that the organization failed to execute a BAA with a major contractor and failed to conduct an organization-wide risk analysis. The contractor had access to the ePHI of 289,904 individuals. This case underscored that both the absence of a BAA and the failure to perform a risk analysis can compound enforcement outcomes.
Raleigh Orthopaedic Clinic: $750,000 (2016)
Raleigh Orthopaedic Clinic in North Carolina agreed to pay $750,000 for releasing x-ray films and related PHI of 17,300 patients to a company that promised to transfer the images to electronic media in exchange for harvesting the silver from the x-ray films. The arrangement was made over the telephone, and no BAA was ever executed. OCR cited a violation of 45 CFR 164.502(e). The corrective action plan required the clinic to designate at least one individual responsible for ensuring BAAs are obtained from all business associates.
CHSPSC LLC: $2.3 Million (2020)
CHSPSC LLC, a business associate providing IT and health information management services to hospitals owned by Community Health Systems, agreed to pay $2.3 million after a cyberattack by an advanced persistent threat group (APT18) resulted in the exfiltration of ePHI belonging to 6,121,158 individuals. Despite being notified by the FBI in April 2014 that its systems were compromised, the attackers maintained access for four months. OCR identified multiple HIPAA Security Rule failures. The settlement included a two-year corrective action plan with close OCR monitoring.
BST & Co. CPAs, LLP (2025)
BST & Co. CPAs, LLP, a New York accounting firm that served as a business associate to Community Care Physicians, reached a settlement with OCR after a ransomware attack in December 2019 compromised the PHI of its covered entity client. BST received financial records containing PHI for tax preparation purposes. This case illustrated that professional service firms, not just healthcare technology vendors, face enforcement as business associates.
How to Structure a Compliant BAA
HHS provides sample BAA provisions and a model BAA on its website. These templates cover HIPAA-specific requirements but are not complete contracts on their own. According to HHS, the sample language "alone may not be sufficient to result in a binding contract under State law" and does not include many formalities and substantive provisions typically found in valid contracts.
Key Drafting Considerations
Scope of services. Define the exact functions the business associate will perform and the categories of PHI involved. Vague descriptions create ambiguity about permitted uses.
Breach notification timelines. HIPAA requires business associates to report breaches within 60 days of discovery, but many covered entities negotiate shorter reporting windows (24 to 72 hours) in their BAAs.
Security standards. While the HIPAA Security Rule sets the floor, a BAA can specify additional security requirements such as encryption standards, access controls, or audit log retention periods.
Subcontractor flow-down. Since the Omnibus Rule, BAAs must address subcontractor obligations. The agreement should specify whether the business associate needs prior written approval before engaging subcontractors who will access PHI.
Indemnification and liability. These provisions go beyond HIPAA requirements but are standard in contract law. They allocate financial responsibility for breaches, investigations, and notification costs.
Term and termination. Beyond the HIPAA-required termination authority, the BAA should address automatic renewal, termination for convenience, and the transition process for returning or destroying PHI.
Governing law. State contract law governs enforceability. Some states have enacted additional data privacy or health information protection laws that may impose requirements beyond HIPAA.
Consult an attorney for advice specific to your situation when drafting, reviewing, or updating a BAA.
BAAs and Cloud Service Providers
Cloud computing raises distinct BAA considerations. HHS has issued guidance on HIPAA and cloud computing confirming that a cloud service provider (CSP) that creates, receives, maintains, or transmits ePHI on behalf of a covered entity is a business associate, even if the CSP processes only encrypted data and does not hold the decryption key.
This means that organizations using cloud-based electronic health record systems, cloud storage for patient records, cloud-hosted practice management software, or cloud-based communication platforms for discussing patient care all need BAAs with their CSP vendors.
Major cloud providers including Amazon Web Services, Microsoft Azure, and Google Cloud offer standard BAAs as part of their HIPAA-eligible service configurations. However, signing a cloud provider's BAA typically covers only specified "HIPAA-eligible" services within the platform, not every service the provider offers.
Related HIPAA Resources
For more on related topics, see:
- When Is a BAA Required? covers specific scenarios where a BAA is and is not necessary
- HIPAA Compliance for Companies discusses the broader compliance framework for organizations handling PHI
- HIPAA Overview provides the full hub for all HIPAA coverage areas
This article provides legal information, not legal advice. HIPAA regulations and enforcement priorities can change. Consult an attorney for advice specific to your situation.
Frequently Asked Questions
What is the difference between a covered entity and a business associate under HIPAA?
A covered entity is a health plan, healthcare clearinghouse, or healthcare provider that conducts certain electronic transactions. A business associate is any outside person or organization that performs functions or activities on behalf of a covered entity involving PHI. The distinction matters because both have separate but overlapping obligations under HIPAA, and a BAA is required whenever a covered entity shares PHI with a business associate.
Does a BAA need to be a standalone contract?
No. HHS allows the required BAA provisions to be incorporated into a broader services agreement between the covered entity and the business associate. The provisions can be part of a master services agreement, a vendor contract, or a standalone document. What matters is that all provisions required by 45 CFR 164.504(e)(2) are present in writing, regardless of the document format.
Can a covered entity be held liable for a business associate's HIPAA violation?
A covered entity can be held liable if it knew of a pattern of activity or practice by the business associate that constituted a material breach of the BAA and failed to take reasonable steps to cure the breach or end the violation. Under 45 CFR 164.504(e)(1), if corrective steps are unsuccessful, the covered entity must terminate the contract or arrangement, if feasible.
Do business associates need BAAs with their own subcontractors?
Yes. The 2013 Omnibus Rule expanded the definition of business associate to include subcontractors that create, receive, maintain, or transmit PHI. Under 45 CFR 164.504(e)(5), the same contract requirements that apply between a covered entity and a business associate also apply between a business associate and its subcontractors. This creates a chain of written agreements extending to every entity handling PHI.
How long does a business associate have to report a breach to the covered entity?
Under the HIPAA Breach Notification Rule at 45 CFR 164.410, a business associate must notify the covered entity of a discovered breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. Many covered entities negotiate shorter reporting deadlines in their BAAs, sometimes requiring notification within 24 to 72 hours.
Updates
Governing law re-checked for recent changes
Removed a fabricated 'report the problem to HHS' compliance alternative from an FAQ answer about business associate violations; the current 45 CFR 164.504(e)(1) only conditions compliance on curing the breach and terminating the contract if feasible.
Governing law re-checked for recent changes
The Law Behind This Article
This article rests on the statutory provisions below, held in our own legal record and retrieved from the official source. Tap a section to read the operative text.
Code of Federal Regulations Title 45
§ 164.402Definitions.In forcecited in 3 of our articles
As used in this subpart, the following terms have the following meanings: Breach means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information. (1) Breach excludes: (i) Any unintentional acquisition, access, or use of protected health information by a workforce member or person acting under the authority of a covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under subpart E of this part. (ii) Any inadvertent disclosure by a person who is authorized to access protected health information at a covered entity or business associate to another person authorized to access protected health information at the same covered entity or business associate, or organized health care arrangement in which the covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted under subpart E of this part.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 7 court opinionsMost recently applied by a court: 2024
Leading cases:
- Ciox Health, LLC v. Hargan (District Court, District of Columbia 2020)“…no formal legal force”). 7 HHS concedes that, pursuant to 45 C.F.R. § 164.402(c)(1), it can take enforcement action a…”
- Owen-Brooks v. DISH Network Corporation (District Court, D. Colorado 2024)“…1301, et seq., and regulations promulgated thereunder in 45 C.F.R. § 164.402, as well as Section 5 of the Federal Tr…”
- Ramirez v. DVA (Court of Appeals for the Federal Circuit 2024)“…hereby re- quiring notice to affected individuals. 45 C.F.R. §§ 164.402, 404. Thus, whether Mr. Ramirez violate…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Reporting HIPAA Breaches: Requirements, Timelines, and Process (2026), HIPAA Compliant Email Services: Encrypted Email for Healthcare (2026)
§ 164.410Notification by a business associate.In forcecited in 2 of our articles
(a) Standard —(1) General rule. A business associate shall, following the discovery of a breach of unsecured protected health information, notify the covered entity of such breach. (2) Breaches treated as discovered. For purposes of paragraph (a)(1) of this section, a breach shall be treated as discovered by a business associate as of the first day on which such breach is known to the business associate or, by exercising reasonable diligence, would have been known to the business associate. A business associate shall be deemed to have knowledge of a breach if the breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is an employee, officer, or other agent of the business associate (determined in accordance with the Federal common law of agency). (b) Implementation specifications: Timeliness of notification. Except as provided in § 164.412, a business associate shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach. (c) Implementation specifications: Content of notification.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
§ 164.502Uses and disclosures of protected health information: General rules.In forcecited in 14 of our articles
(a) Standard. A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter. (1) Covered entities: Permitted uses and disclosures. A covered entity is permitted to use or disclose protected health information as follows: (i) To the individual; (ii) For treatment, payment, or health care operations, as permitted by and in compliance with § 164.506; (iii) Incident to a use or disclosure otherwise permitted or required by this subpart, provided that the covered entity has complied with the applicable requirements of §§ 164.502(b), 164.514(d), and 164.530(c) with respect to such otherwise permitted or required use or disclosure; (iv) Except for uses and disclosures prohibited under § 164.502(a)(5)(i), pursuant to and in compliance with a valid authorization under § 164.508; (v) Pursuant to an agreement under, or as otherwise permitted by, § 164.510; and (vi) As permitted by and in compliance with any of the following: (A) This section. (B) Section 164.512 and, where applicable, § 164.509. (C) Section 164.514(e), (f), or (g).
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 290 court opinionsMost recently applied by a court: 2026
In the courts (editorial summary, independently checked):Section 164.502 is the Privacy Rule's general bar on using or disclosing protected health information. Opis Management Resources, LLC (2013) held it preempted a Florida law compelling release of deceased residents' records to a spouse or named representative; Disability Rights Texas v. Hollis (2024) applied the required-by-law exception.
Leading cases:
- Northwestern Memorial Hospital v. John Ashcroft, Attorney General of the United States (Court of Appeals for the Seventh Circuit 2004, 362 F.3d 923)“…sub-part or by subpart C of part 160 of this subchapter.” 45 C.F.R. § 164.502 (a). Before looking to the various exce…”
- Opis Management Resources, LLC v. Secretary, Florida Agency for Health Care Administration (Court of Appeals for the Eleventh Circuit 2013, 713 F.3d 1291)✓Nursing homes refused to give deceased residents' records to spouses who were not personal representatives under 45 CFR 164.502(g); the Eleventh Circuit held Florida's statute compelling those blanket disclosures was preempted as an obstacle to HIPAA's privacy objectives.
- United States ex rel. Baltazar v. Warden (District Court, N.D. Illinois 2014, 302 F.R.D. 256)“…nduct was protected under HIPAA’s whistleblower exception, 45 C.F.R. § 164.502 (j)(l). 2 Regardless of whether Baltaz…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Connecticut Recording Laws (2026): Hybrid Consent Rules Explained, Michigan Recording Laws (2026): Consent Rules and Participant Exception, How to Find Old Medical Records Online
§ 164.504Uses and disclosures: Organizational requirements.In forcecited in 3 of our articles
(a) Definitions. As used in this section: Plan administration functions means administration functions performed by the plan sponsor of a group health plan on behalf of the group health plan and excludes functions performed by the plan sponsor in connection with any other benefit or benefit plan of the plan sponsor. Summary health information means information, that may be individually identifiable health information, and: (1) That summarizes the claims history, claims expenses, or type of claims experienced by individuals for whom a plan sponsor has provided health benefits under a group health plan; and (2) From which the information described at § 164.514(b)(2)(i) has been deleted, except that the geographic information described in § 164.514(b)(2)(i)(B) need only be aggregated to the level of a five digit zip code. (b)-(d) [Reserved] (e)(1) Standard: Business associate contracts. (i) The contract or other arrangement required by § 164.502(e)(2) must meet the requirements of paragraph (e)(2), (e)(3), or (e)(5) of this section, as applicable.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 10 court opinionsMost recently applied by a court: 2023
Leading cases:
- Bailey v. City of Daytona Beach Shores (District Court, M.D. Florida 2012, 286 F.R.D. 625)“…al records in litigation.” {Id.) Plaintiff relies upon 45 C.F.R. § 164.504 (f)(2)(ii)(C) 1 which states that a gr…”
- Ciox Health, LLC v. Hargan (District Court, District of Columbia 2020)“…n-compliance is itself a violation of the regulations. See 45 C.F.R. § 164.504(e)(1). 4 Not surprisingly,…”
- Trone Health Services, Inc. v. Express Scripts Holding Co. (Court of Appeals for the Eighth Circuit 2020, 974 F.3d 845)“…ed and enforced under their contract claim. In violation of 45 C.F.R. § 164.504(g)(2), the Pharmacies first claim that…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: What Is TPO in HIPAA? Treatment, Payment, and Operations Explained (2026), When Is a Business Associate Agreement Required? (2026)
§ 164.524Access of individuals to protected health information.In forcecited in 23 of our articles
(a) Standard: Access to protected health information —(1) Right of access. Except as otherwise provided in paragraph (a)(2) or (a)(3) of this section, an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set, except for: (i) Psychotherapy notes; and (ii) Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding. (2) Unreviewable grounds for denial. A covered entity may deny an individual access without providing the individual an opportunity for review, in the following circumstances. (i) The protected health information is excepted from the right of access by paragraph (a)(1) of this section.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 88 court opinionsMost recently applied by a court: 2026
In the courts (editorial summary, independently checked):Webb v. Smart Document Solutions, LLC (2007) held the reduced, cost-based fee in section 164.524(c)(4) applies only when the individual himself requests his records, not a law firm acting as his agent. Ciox Health, LLC v. Hargan (2020) vacated 2016 guidance that extended that patient rate to third-party directives.
Leading cases:
- Webb v. Smart Document Solutions, LLC (Court of Appeals for the Ninth Circuit 2007, 499 F.3d 1078)✓A law firm ordered its client's hospital records and was billed a copying company's higher third-party rate; the Ninth Circuit held Section 164.524(c)(4)'s cost-based fee limit applies only when the individual or a personal representative asks, not an attorney acting as agent.
- Evenson v. Hartford Life & Annuity Insurance (District Court, M.D. Florida 2007, 244 F.R.D. 666)✓A therapist refused a subpoena for her psychotherapy notes, citing Section 164.524(a)(1)'s exclusion of those notes from a patient's right of access; the court held that exclusion governs only individual access, not discovery, and ordered the notes produced.
- Ciox Health, LLC v. Hargan (District Court, District of Columbia 2020)“…fee that can be charged for such production. See generally 45 C.F.R. § 164.524. For requests brought by an individual…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: How Long Do Hospitals Keep Medical Records? (2026), Medical Records Retention Laws by State (2026 Guide), Arkansas Medical Records Retention Laws (2026 Guide)
§ 164.526Amendment of protected health information.In forcecited in 3 of our articles
(a) Standard: Right to amend. (1) Right to amend. An individual has the right to have a covered entity amend protected health information or a record about the individual in a designated record set for as long as the protected health information is maintained in the designated record set. (2) Denial of amendment. A covered entity may deny an individual's request for amendment, if it determines that the protected health information or record that is the subject of the request: (i) Was not created by the covered entity, unless the individual provides a reasonable basis to believe that the originator of protected health information is no longer available to act on the requested amendment; (ii) Is not part of the designated record set; (iii) Would not be available for inspection under § 164.524; or (iv) Is accurate and complete. (b) Implementation specifications: Requests for amendment and timely action —(1) Individual's request for amendment. The covered entity must permit an individual to request that the covered entity amend the protected health information maintained in the designated record set.
Official text (excerpt) · last checked 2026-09-02 · Read the full text in our law library · Verify at ecfr.gov
Cited in 15 court opinionsMost recently applied by a court: 2026
In the courts (editorial summary, independently checked):Bondick v. Mitchell Sanchez (2024) held that claims under 45 CFR 164.526 fail as a matter of law because HIPAA creates no private right of action. Mallgren v. Burkholder (2014) reached the same result and pointed the plaintiff to the amendment procedure in subsections (b) through (d) as his remedy.
Leading cases:
- Mallgren v. Burkholder (District Court, E.D. New York 2014, 52 F. Supp. 3d 490)✓A committed psychiatric patient sued because his request to review and correct his records went unfulfilled; the court dismissed, holding the amendment process in 45 CFR 164.526 is enforced by HHS and gives no private right of action, and pointed him to that process instead.
- Crowding v. Secretary of Health and Human Services (United States Court of Federal Claims 2019)✓Vaccine-program counsel filed supplemental records altered in his client's favor and signed by a doctor no longer in practice; reading 45 CFR 164.526 to require a covered entity to preserve the original and append any amendment, the special master cut off fees after that filing.
- Bondick v. Mitchell Sanchez (District Court, D. Oregon 2024)✓A patient sued his former physician for libel over a note in his chart and also claimed a right to amend the record under 45 CFR 164.526(a)(1); the court granted summary judgment, holding HIPAA gives no private right of action, so that claim failed as a matter of law.
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Alaska Medical Records Retention Laws (2026 Guide), Medical Identity Theft: EOB Review, HIPAA Rights, and Fixing Your Records
§ 164.528Accounting of disclosures of protected health information.In forcecited in 2 of our articles
(a) Standard: Right to an accounting of disclosures of protected health information. (1) An individual has a right to receive an accounting of disclosures of protected health information made by a covered entity in the six years prior to the date on which the accounting is requested, except for disclosures: (i) To carry out treatment, payment and health care operations as provided in § 164.506; (ii) To individuals of protected health information about them as provided in § 164.502; (iii) Incident to a use or disclosure otherwise permitted or required by this subpart, as provided in § 164.502; (iv) Pursuant to an authorization as provided in § 164.508; (v) For the facility's directory or to persons involved in the individual's care or other notification purposes as provided in § 164.510; (vi) For national security or intelligence purposes as provided in § 164.512(k)(2); (vii) To correctional institutions or law enforcement officials as provided in § 164.512(k)(5); (viii) As part of a limited data set in accordance with § 164.514(e); or (ix) That occurred prior to the compliance date for the covered entity.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at ecfr.gov
Cited in 8 court opinionsMost recently applied by a court: 2024
Leading cases:
- National Ass'n of Letter Carriers v. United States Postal Service (District Court, S.D. New York 2009, 604 F. Supp. 2d 665)“…ze you to withhold notification under these circumstances. 45 C.F.R. § 164.528 (a)(2) (II) (C). (Compl. Ex. A).…”
- Tripp v. United States (District Court, E.D. Michigan 2024)“…intiff’s entitlement to an accounting of disclosures under 45 C.F.R. § 164.528(a)(1) is an obligation imposed on the c…”
- Wellstar Health System, Inc. v. Jordan (Supreme Court of Georgia 2013, 293 Ga. 12)“…t to individual’s underlying health information). See also 45 CFR § 164.528 (providing for right of individual to…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Search our full record of US law — 2.1 million sections, every state + federal →
Sources and References
- HHS Business Associates Guidance(hhs.gov).gov
- HHS Sample Business Associate Agreement Provisions(hhs.gov).gov
- HHS Direct Liability of Business Associates Fact Sheet(hhs.gov).gov
- 45 CFR 164.504 - Uses and Disclosures: Organizational Requirements(law.cornell.edu)
- HHS HIPAA Enforcement: North Memorial Health Care Settlement(hhs.gov).gov
- HHS HIPAA Enforcement: Raleigh Orthopaedic Clinic Settlement(hhs.gov).gov
- HHS HIPAA Enforcement: CHSPSC LLC Settlement(hhs.gov).gov
- HIPAA Omnibus Rule Final Rule (Federal Register)(govinfo.gov).gov
- HHS Guidance on HIPAA and Cloud Computing(hhs.gov).gov
- HHS HIPAA Enforcement: BST & Co. CPAs Settlement(hhs.gov).gov
- 42 U.S.C. 1320d-6 - Wrongful Disclosure of Health Information(law.cornell.edu)
- HHS Resolution Agreements and Civil Money Penalties(hhs.gov).gov