---
kind: "section"
citation: "42 U.S.C. § 17934"
title: "42"
title_heading: "The Public Health and Welfare"
number: "17934"
heading: "Application of privacy provisions and penalties to business associates of covered entities"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/42/17934"
units:
  - "Chapter 156 — Health Information Technology"
  - "Subchapter III — Privacy"
  - "Part A — Improved Privacy Provisions and Security Provisions"
---

# §17934. Application of privacy provisions and penalties to business associates of covered entities

- (a) **Application of contract requirements—** In the case of a [business associate](/usc/42/17921.md?p=2) of a [covered entity](/usc/42/17921.md?p=3) that obtains or creates [protected health information](/usc/42/17921.md?p=12) pursuant to a written contract (or other written arrangement) described in section 164.502(e)(2) of title 45, Code of Federal Regulations, with such [covered entity](/usc/42/17921.md?p=3), the [business associate](/usc/42/17921.md?p=2) may use and [disclose](/usc/42/17921.md?p=4) such [protected health information](/usc/42/17921.md?p=12) only if such use or [disclosure](/usc/42/17921.md?p=4), respectively, is in compliance with each applicable requirement of section 164.504(e) of such title. The additional requirements of this subchapter that relate to privacy and that are made applicable with respect to [covered entities](/usc/42/17921.md?p=3) shall also be applicable to such a [business associate](/usc/42/17921.md?p=2) and shall be incorporated into the [business associate](/usc/42/17921.md?p=2) agreement between the [business associate](/usc/42/17921.md?p=2) and the [covered entity](/usc/42/17921.md?p=3).
- (b) **Application of knowledge elements associated with contracts—** Section 164.504(e)(1)(ii) of title 45, Code of Federal Regulations, shall apply to a [business associate](/usc/42/17921.md?p=2) described in [subsection (a)](#a), with respect to compliance with such subsection, in the same manner that such section applies to a [covered entity](/usc/42/17921.md?p=3), with respect to compliance with the standards in sections 164.502(e) and 164.504(e) of such title, except that in applying such section 164.504(e)(1)(ii) each reference to the [business associate](/usc/42/17921.md?p=2), with respect to a contract, shall be treated as a reference to the [covered entity](/usc/42/17921.md?p=3) involved in such contract.
- (c) **Application of civil and criminal penalties—** In the case of a [business associate](/usc/42/17921.md?p=2) that violates any provision of subsection [(a)](#a) or [(b)](#b), the provisions of sections 1176 and 1177 of the Social Security Act ([42 U.S.C. 1320d–5](/usc/42/1320d–5.md), 1320d–6) shall apply to the [business associate](/usc/42/17921.md?p=2) with respect to such [violation](/usc/42/2000e–16a.md?p=c) in the same manner as such provisions apply to a person who violates a provision of part C of title XI of such Act [[42 U.S.C. 1320d](/usc/42/1320d.md) et seq.].

## Source credit

(Pub. L. 111–5, div. A, title XIII, § 13404, Feb. 17, 2009, 123 Stat. 264.)

## Notes

### Editorial Notes

### References in Text

This subchapter, referred to in subsec. (a), was in the original “this subtitle”, meaning subtitle D (§ 13400 et seq.) of title XIII of div. A of Pub. L. 111–5, Feb. 17, 2009, 123 Stat. 258, which is classified principally to this subchapter. For complete classification of subtitle D to the Code, see Tables.

The Social Security Act, referred to in subsec. (c), is act Aug. 14, 1935, ch. 531, 49 Stat. 620. Part C of title XI of the Act is classified generally to part C (§ 1320d et seq.) of subchapter XI of chapter 7 of this title. For complete classification of this Act to the Code, see section 1305 of this title and Tables.

### Statutory Notes and Related Subsidiaries

### Effective Date

Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title.