Fact · Dictation for work and study
Under the HIPAA Privacy Rule, a covered entity does not have to obtain satisfactory assurances itself from a business associate's subcontractor. The business associate must obtain those assurances from the subcontractor.
Checked against its source on October 17, 2026
In the source's own words
“A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor.”
45 CFR 164.502: Uses and disclosures of protected health information, Legal Information Institute, Cornell Law School, 2026, 45 CFR 164.502(e)(1)(i) and (ii).
Open the original- What it measures
- The rule lets a business associate pass protected health information to its own subcontractor, which is how an outsourced transcription chain works when a US vendor hands work to another firm.
- What it does not show
- The rule sets the contract chain only. It does not say where the subcontractor is located, and it does not stop a covered entity from writing its own rules into its contract with the business associate.