HIPAA Security Rule 164.314(a)(2)(i): Business Associate Contract Required Provisions

What else in your programme already covers this

This control maps to 59 controls across 21 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27002:2022 · 5 controls

5.19 Information security in supplier relationships
5.20 Addressing information security within supplier agreements
5.21 Managing information security in the ICT supply chain
5.22 Monitoring, review and change management of supplier services
5.31 Legal, statutory, regulatory and contractual requirements

NIST Cybersecurity Framework 2.0 · 5 controls

NIST-CSF-GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally
NIST-CSF-GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
NIST-CSF-GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
NIST-CSF-GV.SC-08 Relevant suppliers and other third parties are included in incident planning, response, and recovery activities
NIST-CSF-RS.CO-02 Internal and external stakeholders are notified of incidents

NIST SP 800-53 Rev 5 · 5 controls

NIST800-CA-3 CA-3 Information Exchange
NIST800-IR-6 IR-6 Incident Reporting
NIST800-PS-7 PS-7 External Personnel Security
NIST800-SA-4 SA-4 Acquisition Process
NIST800-SA-9 SA-9 External System Services

FedRAMP High · 4 controls

SA-4 Acquisition Process
SA-9 External System Services
SR-3 Supply Chain Controls and Processes (SR-3)
SR-8 Notification Agreements (SR-8)

FedRAMP Moderate · 4 controls

SA-4 Acquisition Process
SA-9 External System Services
SR-3 Supply Chain Controls and Processes (SR-3)
SR-8 Notification Agreements (SR-8)

ISO 27001:2022 · 4 controls

5.19 Information security in supplier relationships
5.20 Addressing information security within supplier agreements
5.22 Monitoring, review and change management of supplier services
5.31 Legal, statutory, regulatory and contractual requirements

ISO 27701:2019 · 4 controls

6.12.1 Information security in supplier relationships
6.13.1 Management of information security incidents and improvements
7.2.6 Contracts with PII processors
8.5.7 Engagement of a subcontractor to process PII

NIST SP 800-161 Rev 1 · 4 controls

161R1-AC-20 Use of External Systems
161R1-PM-17 Protecting Controlled Unclassified Information on External Systems
161R1-PS-7 External Personnel Security
161R1-SR-8 Notification Agreements

APRA CPS 234 · 3 controls

CPS234-16 Assessment of Related Party and Third Party Capability
CPS234-P19 Policy Direction to All Responsible Parties
CPS234-P22 Evaluation of Third Party Control Design

CIS Controls v8 · 3 controls

CIS-15.2 Establish and Maintain a Service Provider Management Policy
CIS-15.4 Ensure Service Provider Contracts Include Security Requirements
CIS-15.7 Securely Decommission Service Providers

SOC 2 · 3 controls

SOC2-CC2.3 CC2.3 Communication with external parties about internal control (COSO principle 15)
SOC2-P6.4 P6.4 Privacy commitments from vendors and third parties
SOC2-P6.5 P6.5 Vendor commitments to report unauthorised disclosures

APRA CPS 230 Operational Risk Management · 2 controls

CPS230-47 Monitoring and Senior Management Reporting on Material Arrangements
CPS230-50 Formal Agreement Content for Material Arrangements

C5 (Germany) · 2 controls

C5-HR-06 Confidentiality agreements
C5-SSO-04 Monitoring of compliance with requirements

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-STA-09 Primary Service and Contractual Agreement
CCM-STA-12 Supply Chain Service Agreement Compliance

NIST SP 800-171 Rev 3 · 2 controls

03.12.05 Information Exchange
03.16.03 External System Services

PCI DSS 4.0 · 2 controls

12.8.2 12.8.2 TPSP contracts acknowledging account data responsibility
12.8.5 12.8.5 Responsibility allocation between entity and TPSPs

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-25 Secure Dedicated Network Interconnections with Partners

APEC Cross-Border Privacy Rules (CBPR) System · 1 control

CBPR-PR-35 Processor protection obligations

APPI · 1 control

APPI-A25 Supervision of Trustees

AWS Well-Architected Security Pillar · 1 control

SEC03-BP09 Share resources securely with a third party

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-30 Outsourcing with Retention of Complete Responsibility

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of HIPAA Security Rule have you already done?

HIPAA Security Rule 164.314(a)(2)(i) is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of HIPAA Security Rule your existing evidence covers. Hold ISO 27001:2022 and 53 of 67 HIPAA Security Rule controls already carry evidence.

If you hold ISO 27001:202279.1% covered · 14 gaps If you hold ISO 27002:202279.1% covered · 14 gaps If you hold FedRAMP Moderate77.6% covered · 15 gaps If you hold NIST SP 800-53 Rev 577.6% covered · 15 gaps If you hold C5 (Germany)76.1% covered · 16 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.167.2% covered · 22 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 64 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 each Browse the graph free