# HIPAA BAA Management — Standards and References

## Primary Legal Sources
- **45 CFR §160.103** — Definition of business associate
- **45 CFR §164.502(e)** — Requirement for covered entities to have BAAs
- **45 CFR §164.504(e)** — Required BAA provisions
- **45 CFR §164.314(a)** — Organizational requirements for BA contracts
- **HITECH Act §13401** — Business associate direct liability for Security Rule and certain Privacy Rule provisions
- **HITECH Act §13404** — Application of HIPAA to business associates and subcontractors
- **78 FR 5566** — Omnibus Rule extending HIPAA to business associates and subcontractors (January 25, 2013)

## OCR Guidance
- **OCR Business Associate Guidance** — published at hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates
- **OCR FAQ on Business Associates** — clarifications on BA definition, conduit exception, and BAA requirements
- **OCR Sample BAA Provisions** — published at hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions
- **OCR Guidance on Cloud Computing** — applying BA requirements to cloud service providers

## Industry References
- **ABA Health Law Section** — Model Business Associate Agreement with commentary
- **AHLA (American Health Law Association)** — BAA drafting guidance and updates for Omnibus Rule compliance
- **HITRUST Third Party Assurance Program** — framework for assessing BA security posture