Speed with control
Automate intake, assessment, and monitoring with guardrails that keep your policies in force.
ReportThe 2026 State of TPRMThe 2026 State of TPRM: where programs break and what risk leaders want insteadDownload
Every vendor touching PHI is a business associate. Coverbase helps you keep them accounted for.
HIPAA requires covered entities to sign business associate agreements with vendors handling protected health information (PHI), ensure those terms flow to subcontractors, and notify affected individuals of a breach within 60 days. Coverbase keeps the BAAs, diligence, and monitoring in one place.
CoverbaseHIPAA | business associate
HIPAA | business associate
A subcontractor enters the PHI flow
PHI service
Business associate agreement
Subcontractor
Agent work
01Trace the relationship
02Check BAA terms
03Review safeguards
Change ready for review
Privacy and security see the same service.
Who HIPAA applies to
HIPAA, enforced by the HHS Office for Civil Rights (OCR), applies to covered entities (health plans, health care clearinghouses, and health care providers that conduct standard electronic transactions) and their business associates, the vendors that create, receive, maintain, or transmit PHI. Under the HITECH Act, business associates are directly liable for certain requirements. A proposed update to the Security Rule, published in January 2025, would strengthen ePHI requirements. It isn't final, and HHS's regulatory agenda now targets July 2027.
What HIPAA asks of you
- 01
Business associate agreements
Sign a BAA with every vendor handling PHI, requiring them to safeguard it. - 02
Subcontractor flow-down
Ensure business associates bind their own subcontractors to the same protections. - 03
Safeguards for ePHI
Vendors handling electronic PHI (ePHI) must maintain appropriate security controls. - 04
60-day breach notification
Notify affected individuals without unreasonable delay and within 60 days. Breaches affecting 500 or more people also require notice to HHS and, when more than 500 residents of a state are affected, the media.
Keep your business associates accounted for
The risk isn't the BAA you signed. It's the vendor you forgot. Coverbase keeps the whole business associate population in view.
Business associate registry
A current list of every business associate, its BAA status, and the PHI it handles.Diligence gathered for you
Collect and review vendor security evidence automatically.Data flow visibility
See where PHI goes downstream to subcontractors.Incident-ready records
Keep the vendor facts on hand when a breach clock starts.
One platform for third-party risk and security
Explain with confidence
AI shows its reasoning for each recommendation, so you can explain your ratings and findings.
Automate with assurance
Adapt controls and workflows as your program and its regulations change.
How we protect your data
These are the practices behind the supplier records and evidence you keep in Coverbase. Read our security and privacy program.
To request our SOC 2 report or report a vulnerability, email security@coverbase.ai.
Independent review
A SOC 2 Type II audit against the AICPA Trust Services Criteria for security, availability, and confidentiality.Testing and remediation
External penetration tests every year, plus vulnerability scans and static and dynamic application security tests, with findings tracked through remediation.Identity and production access
SSO and SAML with Okta, Microsoft Entra, Google, and other identity providers. Multi-factor authentication is required for production access.Data protection
Data encrypted at rest with AES-256 and in transit with TLS 1.2 or higher.Internal accountability
Access logging, quarterly least-privilege reviews, and required employee security and privacy training.
HIPAA business associate questions
The service and PHI flow determine which agreements you need.
Is every healthcare vendor a business associate?
No. Look at whether it creates, receives, maintains, or transmits PHI on behalf of a covered entity or another business associate.
Who notifies individuals after a breach of unsecured PHI?
The covered entity generally notifies affected individuals. The business associate generally notifies the covered entity within its own 60-day outside limit, without unreasonable delay.
Does a BAA alone satisfy the Security Rule?
No. We keep the agreement and evidence together; your regulated entity still needs to operate the safeguards required for ePHI.