Effective Date: 12/01/2026 (See HHSAR CD 2026-27)
Subpart 324.1 – Protection of Individual Privacy
324.103 Procedures.
Subpart 324.2 – Freedom of Information Act
324.203 Policy.
Subpart 324.70 – Health Insurance Portability and Accountability Act Requirements
324.7000 Scope of subpart.
324.7001 Compliance with HIPAA business associate contract requirements
Subpart 324.1 – Protection of Individual Privacy
324.103 Procedures.
(b)
(2) HHS implements the Privacy Act of 1974 at 45 CFR part 5b, Privacy Act Regulations. Additional information is available at https://www.hhs.gov/privacy/index.html.
Subpart 324.2 – Freedom of Information Act
324.203 Policy.
(a) The HHS regulation implementing the Freedom of Information Act (FOIA), 5 U.S.C. 552, is set forth in 45 CFR part 5. Additional information is available at https://www.hhs.gov/foia/index.html.
Subpart 324.70 – Health Insurance Portability and Accountability Act Requirements
324.7000 Scope of subpart.
All individually identifiable health information that is “protected health information” (PHI), as defined at 45 CFR 160.103 must be administered in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) implementing regulations at 45 CFR parts 160 and 164 (the HIPAA Privacy, Security, and Breach Notification Rules). Additional information is available at https://www.hhs.gov/hipaa/index.html.
324.7001 Compliance with HIPAA business associate contract requirements.
(a) HHS is a HIPAA “covered entity” that is a “hybrid entity” as these terms are defined at 45 CFR 160.103 and 164.103, respectively. Accordingly, only the portions of HHS that the Secretary has designated as “health care components” (HCC), as defined at 45 CFR 164.103, are subject to HIPAA.
(b) HHS HCCs may use persons or entities known as “business associates,” as defined at 45 CFR160.103, to carry out certain health care activities and functions or to provide certain services that involve the use or disclosure of PHI. Generally, a business associate means a person or entity (including contractors, and third-party vendors, etc.) that—
(1) Creates, receives, maintains, or transmits PHI on behalf of an HHS HCC to carry out HHS HIPAA “covered functions,” as defined at 45 CFR 164.103; or
(2) Provides certain services to an HHS HCC that involve PHI.
(c) When HHS, as a covered entity, is required by 45 CFR 164.502(e)(1) and 164.504(e) and, if applicable, 45 CFR 164.308(b)(3) and 164.314(a), to enter into a HIPAA business associate contract, the contracting officer must ensure that such contract meets the requirements at 45 CFR 164.504(e)(2) and, if applicable, 45 CFR 164.314(a)(2).