§17934 — Title 42 The Public Health and Welfare | U.S. Code

Summary

Business associates who get or create protected health information under a written contract with a covered entity (see 45 C.F.R. 164.502(e)(2)) may only use or share that information if they follow the rules in 45 C.F.R. 164.504(e). Any other privacy rules that apply to covered entities must also apply to the business associate and must be included in the business associate agreement. The rule at 45 C.F.R. 164.504(e)(1)(ii) applies to these business associates the same way it applies to covered entities, except that contract references to a business associate are treated as references to the covered entity. If a business associate breaks these rules, sections 1176 and 1177 of the Social Security Act (42 U.S.C. 1320d–5, 1320d–6) apply to the business associate the same as they do for violations of part C of title XI (42 U.S.C. 1320d et seq.).

Title 42, §17934

The Public Health and Welfare — Source: USLM XML via OLRC

(a)In the case of a business associate of a covered entity that obtains or creates protected health information pursuant to a written contract (or other written arrangement) described in section 164.502(e)(2) of title 45, Code of Federal Regulations, with such covered entity, the business associate may use and disclose such protected health information only if such use or disclosure, respectively, is in compliance with each applicable requirement of section 164.504(e) of such title. The additional requirements of this subchapter that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to such a business associate and shall be incorporated into the business associate agreement between the business associate and the covered entity.

(b)section 164.504(e)(1)(ii) of title 45, Code of Federal Regulations, shall apply to a business associate described in subsection (a), with respect to compliance with such subsection, in the same manner that such section applies to a covered entity, with respect to compliance with the standards in section 164.502(e) and 164.504(e) of such title, except that in applying such section 164.504(e)(1)(ii) each reference to the business associate, with respect to a contract, shall be treated as a reference to the covered entity involved in such contract.

(c)In the case of a business associate that violates any provision of subsection (a) or (b), the provisions of section 1176 and 1177 of the Social Security Act (42 U.S.C. 1320d–5, 1320d–6) shall apply to the business associate with respect to such violation in the same manner as such provisions apply to a person who violates a provision of part C of title XI of such Act [42 U.S.C. 1320d et seq.].

Notes & Related Subsidiaries

Editorial Notes

References in Text

This subchapter, referred to in subsec. (a), was in the original “this subtitle”, meaning subtitle D (§ 13400 et seq.) of title XIII of div. A of Pub. L. 111–5, Feb. 17, 2009, 123 Stat. 258, which is classified principally to this subchapter. For complete classification of subtitle D to the Code, see Tables. The Social Security Act, referred to in subsec. (c), is act Aug. 14, 1935, ch. 531, 49 Stat. 620. Part C of title XI of the Act is classified generally to part C (§ 1320d et seq.) of subchapter XI of chapter 7 of this title. For complete classification of this Act to the Code, see section 1305 of this title and Tables.

Statutory Notes and Related Subsidiaries

Effective Date

Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title.

§17934 Application of privacy provisions and penalties to business associates of covered entities