Yes, if a subcontractor handles protected health information (PHI) by creating, receiving, maintaining, or transmitting it on behalf of a business associate, they absolutely need a business associate agreement (BAA). While you personally won't be signing the second contract, your business associate agreement should stipulate that they must.

The subcontractor becomes a business associate when they handle PHI for your business associate. Mirroring the language from HHS's sample BAA provisions is advisable for your contract.

 

What is considered a subcontractor?

According to HIPAA, a subcontractor is defined as any party engaged to perform a function, activity, or service on behalf of a business associate, excluding individuals who are part of the business associate's workforce. Anyone working for your business associate, as long as they are under that associate's supervision, is counted as part of their workforce. An outside company would not be.

If they are performing an activity that involves PHI, then they would be a business associate. For example, a cardiology practice might hire a billing company that uses an external email service to distribute patient statements. The billing company would be the practice's business associate, while the email service would be the billing company's subcontractor and a business associate under HIPAA.

 

Who signs with the subcontractor

45 CFR 164.502(e)(1)(i) does not require you as the covered entity to obtain satisfactory assurances from a business associate that is considered a subcontractor. 45 CFR 164.502(e)(1)(ii) requires that your business associate obtain satisfactory assurances from the subcontractor before PHI is disclosed.

Using our previous example, your cardiology practice would sign a BAA with your billing company, and they would sign a BAA with their outside service that sends your emails. Your cardiology practice doesn't need to have a BAA with the outside email service.

Your agreement doesn't need to be a standalone document separate from your overall services contract. The HHS guidance indicates that these provisions can either be part of your services agreement or form a separate BAA. Their sample provisions are optional.

 

What the covered entity still has to verify

Your BAA with your business associate should state that they are required to follow the provisions found in 164.502(e)(1)(ii) and 164.308(b)(2). Their duty is to establish a contract with the subcontractor and ensure all terms and conditions outlined in your agreement are followed.

You're always able to verify that your business associate's BAA includes these stipulations. Ask them what subcontractors they have and if they will be receiving PHI. Then ask for their agreements with the subcontractors. The level of vendor diligence you undertake is a choice you get to make.

According to Paubox's vendor vetting tips published in October of 2026. 56% of mid-market respondents answered yes to having a vendor's email security play a role in an incident. Of those, 57% vetted their vendor's email security using a simple survey or the BAA they had with them. This information was pulled from a self-reported survey, so it can't say with certainty that vendors' email security played a role in an incident.

 

How far the requirement extends down the chain

Should your business associate engage a subcontractor for tasks involving PHI, that subcontractor will also need a BAA. If your email provider stores your communications with a third party, that company will also require a BAA.

It's possible that your PHI ends up being stored by entities that are two or three layers removed from the original point of contact. In a JMIR Medical Informatics article, the authors analyzed a total of 6,612 breach reports that were filed with HHS from 2009 to 2025. One of their takeaways was "compromised business associates can expose PHI from multiple (covered entity’s) CEs at once."

 

What to include in your subcontractors' BAA

Your business associates should adhere to the identical procedure as your covered entity when engaging a subcontractor. 45 CFR 164.504(e)(5) outlines what to include when creating your business associate's subcontractor BAA. Some sample language from HHS is provided here for you.

  • Uses and disclosures of PHI that are permitted
  • Safeguards to be put in place
  • Report any impermissible uses or breaches of unsecured PHI
  • Assist with access and amendments if applicable
  • Require any subcontractor to enter into an agreement

Similar to the first section, we discussed your business associate's BAA. Be mindful of the phrasing your business associate uses when making agreements with their subcontractors. As stated in the JMIR article, they should be notifying your organization if there is a breach, and you are responsible for notifying your patients and HHS.

 

Where email sends PHI to subcontractors

Many times, subcontractors are contracted to do tasks that involve email. Sending patient information to a transcriber. Having a collections agency receive information on your accounts. Sending emails to your mailing company to distribute patient statements.

Paubox's data indicates that when your PHI is compromised by a vendor, it's typically because their account was hacked. Or if you've sent an email to them thinking your email was secure when it wasn't.

The JMIR article mentioned earlier found that 55.6% of breaches with a business associate involved occurred on a network server. While only 30.8% of other breaches occurred on a network server. Email made up 13.5% of breaches that involved a business associate. Whereas other types of breaches had a 25.7% rate of involving email.

 

How HIPAA compliant email supports the arrangement

If you use Paubox Email Suite to send PHI to your business associate. Paubox will become your business associate. We provide a BAA with every account we create and state on our healthcare page that your outbound emails will be encrypted. The recipient can open the message in their inbox with no portal or additional login.

By using an encrypted email you are protecting your PHI when it leaves your organization. It's just one less thing your team can forget to do. Your business associate will still need to have a BAA with their outside service that they use to send email. And you should make sure your BAA covers them requiring their subcontractors to follow the same rules.

Also read: 6 Paubox features that healthcare providers need for HIPAA compliance

 

What a signed BAA cannot establish

One should be aware of the specific functions and restrictions of a BAA. The JMIR article points out these are merely contracts, not evidence of the safeguards your business associate actually employs.

They go on to mention that business associates were involved in 22.1% of reported breaches prior to the Omnibus Rule taking effect. From 2014 to 2019, there was a 20.9% chance of a breach involving a business associate. In the years since 2020, there has been a 36.6% chance of a business associate being involved in a breach. With the Omnibus rule now in place, we should anticipate fewer breaches stemming from business associates. But as you can see it hasn't decreased.

This is an observational study, so they can't say if BAAs aren't working or what could have caused this increase. Just know that if a breach involves a business associate, it doesn't mean they are at fault. It could also be due to more people reporting breaches since the Omnibus Rule took effect.

 

FAQs

Can a subcontractor face HIPAA penalties directly?

Yes. A subcontractor that qualifies as a business associate can face direct enforcement for applicable HIPAA violations, including unauthorized disclosures and failures to safeguard electronic PHI. Its responsibilities extend beyond its contractual obligations to the business associate.

 

Does HIPAA allow subcontractors to store patient information outside the United States?

Yes. HIPAA permits overseas storage when the required BAA and other applicable protections are in place. Organizations must consider location-specific risks in their security risk analysis, including difficulties enforcing privacy and security protections in another country.

 

Does a subcontractor need a BAA if it cannot read the encrypted information it stores?

Yes. A cloud subcontractor that stores encrypted PHI remains a business associate even if it does not have the decryption key. Encryption does not remove its business associate status or the requirement for a BAA.