This document provides a decision tree to determine whether a business associate agreement is required. It asks a series of yes or no questions about the use of protected health information and the role of individuals accessing the information to establish whether an agreement is necessary for disclosure of data. If the individual is a healthcare provider seeking information for treatment, a member of the provider's workforce, or only a conduit of incidental information, then an agreement is not required. For all other cases, an agreement is required.

1. Do the services involve the use or
disclosure of “protected health No
information”?
Yes
Is the person a health care provider
seeking information for treatment Yes
purposes?
No
Is the person a member of the health
Yes
care providers "workforce"?
No
Business
Is the person/entity only a conduit of Associate
information or is access to "protected Yes Agreement
health information" incidental? IS NOT
required
No
Is the person/entity performing services No
on behalf of the provider?
Yes
Is the information involved restricted to Yes
a "limited data set"?
No
Is the disclosure preparatory to
research or under an IRB approved Yes
waiver for research?
No
Business
Associate
Agreement
IS
required