Skip to main content

Business Associates

A Business Associate is a third party who accesses, creates, receives, maintains, or transmits PHI in order to perform a service on behalf of University of Utah Health.

A Business Associate Agreement outlines permitted use, disclosure, restrictions, and outlines any safeguards to protect any restricted information that may be shared with the business associate.

Business Associate Agreements

A Business Associate Agreement (BAA) spells out:

  • How the Business Associate will use/disclose our PHI
  • Appropriate safeguards to protect our information
  • That the Business Associate will develop a BAA with all their sub-contractors
  • That the Business Associate will have our PHI available on request and available for amendment and/or available for accounting of disclosures
  • At termination of the contract, all PHI must be returned or destroyed or the PHI contract protections may be extended

Questions regarding Business Associates or a Business Associate Agreement should be directed to the Privacy Office at 801-587-9241.

Business Partners HIPAA Training

Business Partners and Vendors

This online training is required by the University of Utah Privacy Office for non-employee business partners, vendors, and other third parties. It is not meant to provide legal advice, direction, or any other advice to any individual.


  1. Read the training module. 
  2. On the last page of the training module, click the link to open the certificate document.
  3. Print the certificate.
  4. Fill in the required fields, sign and date the certificate.

This training is in Adobe Acrobat .pdf format. Adobe Reader is required to view the document.