Government and public statistics
Health App Use Scenarios & HIPAA
U.S. Department of Health and Human Services, Office for Civil Rights, 2016
Read the originalRead on October 17, 2026
- What it is
- A 2016 HHS Office for Civil Rights document that applies HIPAA's definition of a business associate to health app developers, with scenarios. It explains when a vendor that handles health information for a covered entity takes on HIPAA duties.
- How much weight it carries
- Official HHS guidance, read from an archived copy of the PDF because hhs.gov refused automated access on 2026-10-17. It dates from 2016 and is a set of worked scenarios, not a regulation, so the outcome depends on each set of facts.
Facts taken from this source
- HHS says most vendors and contractors that provide services to covered entities, and that involve access to protected health information, are business associates.
“most vendors or contractors (including subcontractors) that provide services to or perform functions for covered entities that involve access to PHI are business associates.” (Introduction)