---
kind: "section"
citation: "42 U.S.C. § 17938"
title: "42"
title_heading: "The Public Health and Welfare"
number: "17938"
heading: "Business associate contracts required for certain entities"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/42/17938"
units:
  - "Chapter 156 — Health Information Technology"
  - "Subchapter III — Privacy"
  - "Part A — Improved Privacy Provisions and Security Provisions"
---

# §17938. Business associate contracts required for certain entities


Each organization, with respect to a [covered entity](/usc/42/17921.md?p=3), that provides data transmission of [protected health information](/usc/42/17921.md?p=12) to such entity (or its [business associate](/usc/42/17921.md?p=2)) and that requires access on a routine basis to such [protected health information](/usc/42/17921.md?p=12), such as a Health Information Exchange Organization, Regional Health Information Organization, E-prescribing Gateway, or each vendor that contracts with a [covered entity](/usc/42/17921.md?p=3) to allow that [covered entity](/usc/42/17921.md?p=3) to offer a [personal health record](/usc/42/17921.md?p=11) to patients as part of its [electronic health record](/usc/42/17921.md?p=5), is required to enter into a written contract (or other written arrangement) described in section 164.502(e)(2) of title 45, Code of Federal Regulations and a written contract (or other arrangement) described in section 164.308(b) of such title, with such entity and shall be treated as a [business associate](/usc/42/17921.md?p=2) of the [covered entity](/usc/42/17921.md?p=3) for purposes of the provisions of this subchapter and subparts C and E of part [164](/usc/45/164.md) of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009.


## Source credit

(Pub. L. 111–5, div. A, title XIII, § 13408, Feb. 17, 2009, 123 Stat. 271.)

## Notes

### Editorial Notes

### References in Text

This subchapter, referred to in text, was in the original “this subtitle”, meaning subtitle D (§ 13400 et seq.) of title XIII of div. A of Pub. L. 111–5, Feb. 17, 2009, 123 Stat. 258, which is classified principally to this subchapter. For complete classification of subtitle D to the Code, see Tables.

### Statutory Notes and Related Subsidiaries

### Effective Date

Section effective 12 months after Feb. 17, 2009, except as otherwise specifically provided, see section 13423 of Pub. L. 111–5, set out as a note under section 17931 of this title.