Covered entityclinician, practice, health plan
- HIPAA
- State medical privacy law
“Will sign a BAA” is your green light — but you still have to execute it.
← The Health AI Toolkit
Who this applies to
A BAA only matters if you need one. Not everyone working in health is a covered entity, and non-covered entities still have obligations.
Business associatehandling PHI for a covered entity
- HIPAA via BAA
- Your contract terms
Check your contract before the vendor’s terms. Subcontracting rules are where this usually goes wrong.
Neithercash-pay aesthetics, coaching, brands
- FTC Health Breach Rule
- State consumer-health law
- FTC Act §5
HIPAA may not apply to you — not the same as no obligations. State laws reach consumer health data HIPAA never touches.
Researchstudies, publication, quality work
- Common Rule
- IRB
- HIPAA if source data is PHI
Ask your IRB before you paste. A de-identified dataset can still be a protocol deviation.
Primary sources
- HIPAA for professionals — Privacy, Security, and Breach Notification RulesU.S. Department of Health and Human Services, Office for Civil RightsChecked 2026-08-06
- Health Breach Notification RuleFederal Trade CommissionChecked 2026-08-06
- Clinical Decision Support Software — guidance for industry and FDA staffU.S. Food and Drug AdministrationChecked 2026-08-06
- My Health My Data Act — consumer health data outside HIPAAWashington State Attorney GeneralChecked 2026-08-06
- Medical privacy and the Confidentiality of Medical Information ActCalifornia Attorney GeneralChecked 2026-08-06
This orients; it does not advise. Reach your own conclusion with your own counsel. Not legal advice, and no professional relationship is created.