Fact · Voice privacy and security
HHS says that lacking an encryption key does not exempt a cloud service provider from business associate status under HIPAA.
Checked against its source on October 16, 2026
In the source's own words
“Lacking an encryption key does not exempt a CSP from business associate status and obligations under the HIPAA Rules.”
Guidance on HIPAA & Cloud Computing, U.S. Department of Health and Human Services, Office for Civil Rights, n.d., Question 2: If a CSP stores only encrypted ePHI and does not have a decryption key, is it a HIPAA business associate?.
Open the original- What it measures
- CSP means cloud service provider. HHS answers this question in its guidance on cloud computing, which applies to any service that holds health information for a covered entity.
- What it does not show
- The guidance covers cloud providers that hold ePHI for a covered entity. It does not address whether a consumer dictation app is a business associate; that depends on the contract and the relationship.