Your security and compliance glossary

All the terms you need to know when you’re trying to get compliance audit ready, fast.

Show filters

What is a HIPAA business associate?

A HIPAA business associate is a person or entity that performs certain functions or activities involving the use or disclosure of protected health information (PHI) on behalf of, or through the provision of services to, a covered entity. For example, health plans, health care clearinghouses, and certain health care providers.


Most providers and plans do not carry out all of their health care activities and functions by themselves; they often use the services of other persons and businesses. The HIPAA Privacy Rule allows covered entities to disclose protected health information to these business associates if the providers or plans obtain satisfactory assurances the business associate will:

  • Use the information only for the purposes they’ve been engaged 
  • Safeguard the information from misuse
  • Help the covered entity comply with some of the covered entity’s duties under the Privacy Rule  


HIPAA Rules apply to covered entities as well as business associates. Suppose a covered entity engages a business associate to help carry out its health care activities and functions. In that case, the business associate must comply with HIPAA, and the covered entity must have a written business associate contract or another arrangement with the business associate that establishes the engagement specifics.


Covered entities may disclose protected health information to an entity in its role as a business associate only to help the covered entity carry out its health care functions—not for the business associate’s independent use or purposes, except as needed for the proper management and administration of the business associate.

Additional resources you might like:

Compliance
Events
Live Demo: Automating Compliance for SOC 2, ISO 27001, HIPAA, and More

Discover how Vanta’s automation and AI tools can help your team simplify compliance, strengthen security, and scale trust across frameworks like SOC 2, ISO 27001, HIPAA, and more.

AWS
Events
Turn security into your startup’s secret sales weapon

In this joint session with AWS, Vanta, and BreachRx, you’ll learn how early-stage teams are turning that pressure into an advantage.

Compliance
Events
Inside the FedRAMP 20x Pilot: Lessons Learned with Vanta

Join Vanta’s GRC team for an inside look at our journey submitting the first FedRAMP 20x pilot submission - a new initiative that fast-tracks the path to FedRAMP Low authorization without the need for an agency sponsor.

Additional resources you might like:

Compliance
Events
Live Demo: Automating Compliance for SOC 2, ISO 27001, HIPAA, and More

Discover how Vanta’s automation and AI tools can help your team simplify compliance, strengthen security, and scale trust across frameworks like SOC 2, ISO 27001, HIPAA, and more.

AWS
Events
Turn security into your startup’s secret sales weapon

In this joint session with AWS, Vanta, and BreachRx, you’ll learn how early-stage teams are turning that pressure into an advantage.

Compliance
Events
Inside the FedRAMP 20x Pilot: Lessons Learned with Vanta

Join Vanta’s GRC team for an inside look at our journey submitting the first FedRAMP 20x pilot submission - a new initiative that fast-tracks the path to FedRAMP Low authorization without the need for an agency sponsor.

Product updates
Blog
Introducing the all-new Vanta AI Agent to supercharge GRC teams

The Vanta AI Agent guides you through key compliance workflows and takes action on your behalf.

NIS 2
Events
Simplify Your Path to NIS 2 Compliance

Join us to explore Vanta’s NIS 2 solution, which automates up to 65% of compliance tasks through pre-built controls, templates, and cross-framework integrations—all with continuous monitoring for complete visibility over your security posture.

HIPAA
Blog
SOC 2 vs. HIPAA: Everything you need to know

How to tackle both certifications with ongoing security monitoring

HIPAA
Blog
5 practical tips to navigate AI, security, and compliance in healthcare

Healthcare companies must balance AI innovation with risk mitigation to provide the best solutions and care without introducing additional risk.

SOC 2
Events
Live Demo: Simplify ISO 27001 and SOC 2 compliance with Vanta

Watch our on-demand demo to learn how Vanta can help simplify compliance needs across over 35 frameworks like SOC 2 and ISO 27001!

GRC
Events
Scaling Governance, Risk, and Compliance with Trust

Hear from ShipBob’s Heidi Pili and CMG’s Josh Wasserman on scaling your GRC program, with insights on key trends, Vanta use cases, and effective communication strategies.