HIPAA Privacy Rule
The rule applies to health plans, health care clearinghouses, and providers who bill electronically. A vendor that handles PHI for one of them is a business associate and needs a business associate agreement before PHI moves. The minimum necessary standard limits most uses and disclosures to what the task needs.
Source: HHS, The HIPAA Privacy Rule, https://www.hhs.gov/hipaa/for-professionals/privacy. Page read October 14, 2026.