HITECH Act 13408: Section 13408: health information exchanges, e-prescribing gateways and PHR vendors serving covered entities are business associates and must have contracts

An organization that provides data transmission of protected health information to a covered entity or its business associate and requires routine access to it (a health information exchange organization, a regional health information organization, an e-prescribing gateway) or that contracts with a covered entity to offer a personal health record to patients as part of its electronic health record must enter into a business associate contract under 45 CFR 164.502(e)(2) and 164.308(b) and is treated as a business associate for the subtitle and the Privacy and Security Rules.