Government and public statistics

45 CFR 164.502: Uses and disclosures of protected health information

Legal Information Institute, Cornell Law School, 2026

Read on October 16, 2026

What it is: The HIPAA Privacy Rule section that sets general rules for using and disclosing protected health information, including disclosure to business associates.
How much weight it carries: The federal regulation as published by Cornell LII. It is primary law.

Facts taken from this source

Under the HIPAA Privacy Rule, a covered entity does not have to obtain satisfactory assurances itself from a business associate's subcontractor. The business associate must obtain those assurances from the subcontractor.
“A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor.” (45 CFR 164.502(e)(1)(i) and (ii))
HIPAA's Privacy Rule lets a covered entity allow a business associate to create, receive, maintain or transmit protected health information on its behalf only if the entity obtains satisfactory assurance that it will be safeguarded.
“A covered entity may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information” (45 CFR 164.502(e)(1)(i))