What is a HIPAA business associate? The vendor rule, the 60-day notice and the breach count

A business associate, under the HIPAA rules, is a person or company outside a health care provider's or health plan's workforce that creates, receives, maintains or transmits protected health information on that client's behalf, or provides services such as billing, claims processing, legal, accounting or consulting work that involve the client's health data.

Who counts as a business associate?

The definition in 45 CFR 160.103 turns on what the company does with the client's health data, not on what kind of company it is. Three groups are named outright. The first is data transmission services that need routine access to the data, such as a health information organization or an e-prescribing gateway. The second is a company offering a personal health record for a covered entity. The third is a subcontractor that handles the data for another business associate. A covered entity can itself be another covered entity's business associate.

The rule also lists who is not one. A health care provider that receives a patient's information for treatment is not the sender's business associate. Neither is a plan sponsor receiving data from its group health plan within the rule's limits.

What must a business associate do after a breach?

It must tell its client. Under 45 CFR 164.410, a business associate that discovers a breach of unsecured protected health information notifies the covered entity without unreasonable delay, and in no case later than 60 calendar days after discovery, except as section 164.412 provides. The clock starts on the first day the breach is known, or would have been known with reasonable diligence, to any employee, officer or other agent except the person committing it.

The notice must identify, as far as possible, each person whose information was or is reasonably believed to have been accessed, acquired, used or disclosed. The business associate also passes on whatever else the covered entity needs for its own letters to patients, at the time of notice or as the information becomes available. Those letters, the notice to HHS and the media notice for large breaches are the covered entity's duties under the HIPAA Breach Notification Rule.

How much of the HHS breach list comes from business associates?

Most of the people counted. The HHS Office for Civil Rights portal lists 725 breach reports under investigation, submitted between 12 October 2023 and 16 October 2026 (CSV export read on 13 November 2026). Business associates filed 139 of them, 19.2%. Those 139 reports count 110,054,221 of the 190,555,616 people on the list, 57.8%.

Who filed the report	Reports	People affected	Share of reports	Share of people
Healthcare provider	550	50,902,270	75.9%	26.7%
Business associate	139	110,054,221	19.2%	57.8%
Health plan	36	29,599,125	5.0%	15.5%
All open reports	725	190,555,616	100%	100%

A business associate is also marked as present on 165 reports, including some that a provider or plan filed. Hacking or an IT incident is the breach type on 128 of the 139 reports business associates filed. The median business associate report counts 8,545 people, against 6,243 for the list as a whole.

Method: we exported the portal's list of cases under investigation as CSV on 13 November 2026 and grouped it by the "Covered Entity Type" column, summing "Individuals Affected". The list holds open cases only; closed cases sit in the portal's archive and are not counted here.

The largest business associate reports on the open list

Business associate	State	Submitted	People affected
Conduent Business Services	NJ	Oct 8, 2025	62,224,658
Aesto	AL	Jul 31, 2026	9,540,683
Episource	CA	Jun 6, 2025	6,725,572
Unlimited Technology Systems	OH	Jul 21, 2026	3,803,750
CareCloud	NJ	Jul 24, 2026	3,756,469
TriZetto Provider Solutions	MO	Feb 6, 2026	3,433,965
Veradigm	IL	Sep 22, 2025	2,672,036
Navia Benefit Solutions	WA	Mar 18, 2026	2,151,330
Insightin Health	MD	Jan 16, 2026	1,949,534
Xsolis	TN	Jun 5, 2026	1,396,519

Every one of the ten is a hacking or IT incident on a network server. The 2026 reports alone are ranked in the largest healthcare data breaches of 2026.

Why it matters to a CISO

At a provider or plan, a vendor's breach arrives as a notice from the vendor. The 60-day limit runs from the vendor's discovery, not from the day the client hears of it, so the client's own notice planning starts with whatever the vendor sends and when. At a vendor, the definition decides whether the company is in HIPAA's scope at all. A subcontractor two steps away from the patient is still a business associate.

What it is not

A business associate is not the covered entity. It does not hold the patient or member relationship, and the HIPAA rule puts the letters to patients on the covered entity.

Where it appears on cisonews.net

Why you got a breach letter from a company you never dealt with explains the vendor letters in the record. Who sends the breach notice when a vendor is hacked? compares two of them. The health care sector of the incident log holds the provider, plan and vendor entries side by side.