PRIA Logo™
Title 42, The Public Health and WelfareRelease 119-102

§17938 Business Associate Contracts Required for Certain Entities

Title 42 › CHAPTER 156 — HEALTH INFORMATION TECHNOLOGY › SUBCHAPTER III — PRIVACY › Part A — Improved Privacy Provisions and Security Provisions › § 17938

Last updated Aug 21, 2026|Official source

Summary

Organizations that send protected health information to a covered entity (or its business associate) and routinely need access must have a written contract or arrangement with that entity. Examples include Health Information Exchanges, Regional Health Information Organizations, e‑prescribing gateways, and vendors offering personal health records. The contracts must follow 45 C.F.R. 164.502(e)(2) and 164.308(b), and those organizations are treated as business associates under subparts C and E of 45 C.F.R. part 164 as of February 17, 2009.

Full Legal Text

Title 42, §17938

The Public Health and Welfare, Source: USLM XML via OLRC

Each organization, with respect to a covered entity, that provides data transmission of protected health information to such entity (or its business associate) and that requires access on a routine basis to such protected health information, such as a Health Information Exchange Organization, Regional Health Information Organization, E-prescribing Gateway, or each vendor that contracts with a covered entity to allow that covered entity to offer a personal health record to patients as part of its electronic health record, is required to enter into a written contract (or other written arrangement) described in section 164.502(e)(2) of title 45, Code of Federal Regulations and a written contract (or other arrangement) described in section 164.308(b) of such title, with such entity and shall be treated as a business associate of the covered entity for purposes of the provisions of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009.

Legislative History

Notes & Related Subsidiaries

Editorial Notes

References in Text

This subchapter, referred to in text, was in the original “this subtitle”, meaning subtitle D (§ 13400 et seq.) of title XIII of div. A of Pub. L. 111–5, Feb. 17, 2009, 123 Stat. 258, which is classified principally to this subchapter. For complete classification of subtitle D to the Code, see Tables.

Statutory Notes and Related Subsidiaries

Effective Date

Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title.

Reference

Citations & Metadata

Citation

42 U.S.C. § 17938

Title 42, The Public Health and Welfare

Last Updated

Aug 21, 2026

Release point: 119-102