Fact · Voice privacy and security
HHS says most vendors and contractors that provide services to covered entities, and that involve access to protected health information, are business associates.
Checked against its source on October 17, 2026
In the source's own words
“most vendors or contractors (including subcontractors) that provide services to or perform functions for covered entities that involve access to PHI are business associates.”
Health App Use Scenarios & HIPAA, U.S. Department of Health and Human Services, Office for Civil Rights, 2016, Introduction.
Open the original- What it measures
- HHS wrote this to explain the business associate definition to app developers. The sentence is its general rule, followed by examples of a company that runs a patient portal for a covered entity.
- What it does not show
- A 2016 document about health apps, with scenarios that HHS says depend on the facts. It is a general rule, not a ruling on any particular dictation product.