Is a software vendor a business associate of a covered entity?
The mere selling or providing of software to a covered entity does not give rise to a business associate relationship if the vendor does not have access to the protected health information of the covered entity. If the vendor does need access to the protected health information of the covered entity in order to provide its service, the vendor would be a business associate of the covered entity. For example, a software company that hosts the software containing patient information on its own server or accesses patient information when troubleshooting the software function, is a business associate of a covered entity. In these examples, a covered entity would be required to enter into a business associate agreement before allowing the software company access to protected health information. However, when an employee of a contractor, like a software or information technology vendor, has his or her primary duty station on-site at a covered entity, the covered entity may choose to treat the
Related Questions
- Does a Business Associate (an agent) need to report a breach to HHS or should it be reported to the carrier (a covered entity) and the covered entity report to HHS?
- May a covered entity share protected health information directly with another covered entity’s business associate?
- Is a software vendor a business associate of a covered entity?
