Which term is used in HIPAA to describe a party that handles protected health information on behalf of a covered entity?

• A. Business Associate
• B. Outsourcer
• C. Service Provider
• D. Processor

Answer: (A)

In HIPAA, the party that handles protected health information on behalf of a covered entity is described as a business associate. A business associate is any person or organization (other than a member of the covered entity’s workforce) that performs functions or activities involving PHI or provides services to the covered entity that involve using or disclosing PHI. They must protect PHI and comply with HIPAA rules through a formal business associate agreement, which also covers duties if subcontractors are involved. The other terms listed aren’t the formal HIPAA designation for this role, so the best descriptor is business associate.