Is your law or accounting firm a HIPAA business associate?

What makes a law or accounting firm a HIPAA business associate?

A law or accounting firm becomes a HIPAA business associate when it performs a professional service for a covered entity that involves receiving protected health information (PHI). Under 45 CFR 160.103, a business associate includes anyone who provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial services to a covered entity, where the service involves disclosure of PHI from that covered entity. Covered entities are health plans, healthcare clearinghouses and healthcare providers that conduct standard transactions, such as claims, electronically.

The test looks at the service and the data, whatever industry the firm considers itself part of. Common examples:

• A law firm defending a medical practice in a malpractice or billing dispute that receives patient charts.
• A CPA firm auditing a hospital or clinic that reviews patient-level receivables or billing records.
• A firm advising an employer's group health plan, which is itself a covered entity, on claims or appeals involving member information.
• A consultant reviewing a practice's coding or revenue cycle with access to claims data.

If the work never involves PHI, the firm is not a business associate for that engagement. The definition also reaches downstream: a subcontractor that creates, receives, maintains or transmits PHI on behalf of a business associate is a business associate too.

What is a business associate directly liable for?

Business associates answer to HHS on their own, independent of the contract. HHS's fact sheet on direct liability lists the requirements, including:

• Complying with the HIPAA Security Rule.
• Notifying the covered entity, or the upstream business associate, of a breach.
• Avoiding uses and disclosures of PHI that the rules or the contract do not permit.
• Limiting PHI to the minimum necessary for the purpose.
• Signing business associate agreements with subcontractors that create or receive PHI, and acting on a known material breach of those agreements.
• Cooperating with HHS investigations and providing records and compliance reports.

Does the Security Rule apply to a small firm?

Yes. The Security Rule applies to every business associate regardless of size, and it starts with a risk analysis: an accurate and thorough assessment of the risks and vulnerabilities to the ePHI the firm holds, followed by security measures that reduce them to a reasonable and appropriate level. The rule lets a firm scale its measures to its size and resources. It does not let a firm skip the analysis.

Accounting firms are already in the enforcement record. In August 2025, HHS's Office for Civil Rights settled with BST & Co. CPAs, a New York accounting and consulting firm acting as a business associate, for $175,000 after a ransomware attack reached PHI it received from a covered entity client. OCR found the firm had not conducted an accurate and thorough risk analysis, and the settlement includes two years of OCR monitoring. Our article on HIPAA risk analysis enforcement explains why OCR keeps returning to this failure.

What must the business associate agreement say?

The contract terms are set by regulation. Under 45 CFR 164.504(e), a business associate agreement must establish the permitted uses and disclosures of PHI and require the business associate to:

• Use or disclose PHI only as the agreement permits or the law requires.
• Use appropriate safeguards and comply with the Security Rule for electronic PHI.
• Report any use or disclosure not provided for by the agreement, including breaches of unsecured PHI.
• Ensure subcontractors that handle the PHI agree to the same restrictions.
• Make PHI available for individuals' access, amendment and accounting rights as the agreement specifies.
• Make its internal practices, books and records available to HHS.
• Return or destroy the PHI when the engagement ends, where feasible.

Healthcare clients often send their own form. Read it for terms stricter than the regulation, especially breach reporting deadlines, cyber insurance requirements and audit rights. Those terms bind the firm by contract even where HIPAA would allow more.

How fast must a business associate report a breach?

Without unreasonable delay and no later than 60 calendar days after discovery, under 45 CFR 164.410. The notice goes to the covered entity, which handles notice to patients, and must identify each individual whose unsecured PHI was, or is reasonably believed to have been, involved, along with any other information the covered entity needs for its own notices. An agreement can set a shorter window, and when it does, the contract deadline is the one the firm has to meet.

Who downstream needs a business associate agreement with your firm?

Any vendor that creates, receives, maintains or transmits the PHI for you. For a law or accounting firm, that list usually includes the managed IT provider, the cloud document management or file-sharing service, the e-discovery or litigation support vendor, the tax or audit software provider that hosts client files, and offsite backup. A missing subcontractor agreement is one of the failures HHS lists as directly enforceable against the business associate.

Does the proposed Security Rule update change anything for business associates yet?

No. The proposal is not final as of this writing, so today's rules still apply. In January 2025, HHS published a proposed overhaul of the Security Rule. Among other changes, it would require business associates to verify their technical safeguards to covered entities at least annually and to notify covered entities within 24 hours of activating a contingency plan. We track where the HIPAA Security Rule update stands. Firms that build an asset inventory, MFA and tested backups now will have less to do if it is adopted.

What should your firm do this quarter?

• List every client that is a health plan, clearinghouse or provider, and every matter or engagement where your firm receives PHI.
• Collect the signed business associate agreements and note each one's breach reporting deadline.
• Run or update a risk analysis covering where PHI lives: email, the document management system, file shares, tax and audit platforms, and laptops.
• Confirm MFA, encryption and tested backups on every system in that analysis.
• Sign business associate agreements with each subcontractor that touches the PHI.
• Write the shortest contractual breach deadline into your incident response plan.

How does s90 help?

s90 works with law and accounting firms in Los Angeles and Orange County to find where client PHI lives, run the Security Rule risk analysis, and keep the evidence a covered entity client or OCR will ask for. Our agreements include 72-hour breach notification and 24-hour evidence production, which helps firms meet the reporting terms in their own business associate agreements. Talk to s90 about your HIPAA obligations.