← HIPAA · Organisational requirements
164.308(b)(1) — Business associate contracts (R)
Requirement
A covered entity may permit a business associate to create, receive, maintain or transmit electronic protected health information on its behalf only if it obtains satisfactory assurances, documented through a written business associate agreement, that the business associate will appropriately safeguard the information.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Finding any of these outranks coverage — a policy that admits the gap is worse than silence.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| GDPR | Art.28 | Processors and processing agreements | vendor-management third-party |
| CCPA/CPRA | 1798.100(d) | Contracts with service providers, contractors and third parties | vendor-management third-party |
| SOC 2 | CC9.2 | Vendor and business partner risk management | vendor-management third-party |
| ISO 27001 | A.5.19 | Information security in supplier relationships | vendor-management third-party |
| PCI DSS 4.0.1 | 12.8 | Third-party service provider management | vendor-management third-party |
| GLBA | 314.4(f) | Oversight of service providers | vendor-management third-party |
| NIST CSF 2.0 | GV.SC-03 | Supply chain risk management is integrated | vendor-management third-party |
| NDPA 2023 | s.29 | Data processor engagement | vendor-management third-party |