42 U.S.C. § 17938
Business associate contracts required for certain entities
United States · Title 42 — THE PUBLIC HEALTH AND WELFARE · Status: effective
Cite this
- Citation
- 42 U.S.C. § 17938, Business associate contracts required for certain entities, United States, version 1 as recorded 2026-07-09, yourstate.us, https://yourstate.us/provision/484615
- Permanent ID
ys:prov:484615@1- SHA-256
312d7dd9ecab6eed9d9319db82be9e1cee245357ed53d8703c71693866edb23b
The hash is SHA-256 of this version's text, with every run of whitespace collapsed to a single space and the ends trimmed. The ID always leads back here, and checking it says whether the text you cited is still the current version.
Full text
Each organization, with respect to a covered entity, that provides data transmission of protected health information to such entity (or its business associate) and that requires access on a routine basis to such protected health information, such as a Health Information Exchange Organization, Regional Health Information Organization, E-prescribing Gateway, or each vendor that contracts with a covered entity to allow that covered entity to offer a personal health record to patients as part of its electronic health record, is required to enter into a written contract (or other written arrangement) described in section 164.502(e)(2) of title 45, Code of Federal Regulations and a written contract (or other arrangement) described in section 164.308(b) of such title, with such entity and shall be treated as a business associate of the covered entity for purposes of the provisions of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009.
Legislative history
The public laws that enacted or amended this section. Tallies are for the whole bill as it passed each chamber — often an omnibus covering far more than this provision — not a vote on this section alone.
- American Recovery and Reinvestment Act of 2009