HITECH Act 13404: Section 13404: HIPAA Privacy Rule use and disclosure limits and penalties apply directly to business associates

A business associate that obtains or creates protected health information under a business associate contract may use and disclose it only in compliance with each applicable requirement of 45 CFR 164.504(e), the additional privacy requirements of the subtitle apply to it and are written into the agreement, the knowledge-of-pattern rule of 164.504(e)(1)(ii) applies to the business associate with respect to the covered entity's compliance, and the civil and criminal penalties apply to a business associate that violates these provisions.