{"data":{"id":"us/42-u.s.c.-17938","jurisdiction":"us","citation":"42 U.S.C. § 17938","heading":"Business associate contracts required for certain entities","body":"Each organization, with respect to a covered entity, that provides data transmission of protected health information to such entity (or its business associate) and that requires access on a routine basis to such protected health information, such as a Health Information Exchange Organization, Regional Health Information Organization, E-prescribing Gateway, or each vendor that contracts with a covered entity to allow that covered entity to offer a personal health record to patients as part of its electronic health record, is required to enter into a written contract (or other written arrangement) described in section 164.502(e)(2) of title 45, Code of Federal Regulations and a written contract (or other arrangement) described in section 164.308(b) of such title, with such entity and shall be treated as a business associate of the covered entity for purposes of the provisions of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009.","path":["Title 42—THE PUBLIC HEALTH AND WELFARE","CHAPTER 156—HEALTH INFORMATION TECHNOLOGY"],"source_url":"https://uscode.house.gov/download/releasepoints/us/pl/119/103/xml_usc42@119-103.zip","current_through":"Public Law 119-103 (09/02/2026)","vintage":"","retrieved_at":"2026-09-10T06:00:34Z","sha256":"312d7dd9ecab6eed9d9319db82be9e1cee245357ed53d8703c71693866edb23b","source_id":"us","stale":true,"prev":"us/42-u.s.c.-17937","next":"us/42-u.s.c.-17939"},"notice":"GroundRules: Original legal text. Not legal advice."}