Compliance for Business Associates

Yes. Every Stampwell certificate includes a QR code linked directly to the Certificate Ledger. A covered entity's compliance officer, credentialing team, or legal counsel scans it and gets instant verification — no phone calls, no PDFs to chase down, no doubt.

A Business Associate is any vendor, contractor, or partner that creates, receives, maintains, or transmits protected health information (PHI) on behalf of a HIPAA covered entity. Common examples include billing companies, IT service providers, EHR vendors, cloud storage providers, law firms, accounting firms, and answering services. If your work involves access to patient data for a hospital, health plan, or healthcare provider — you are almost certainly a Business Associate.

Federal law sets the floor: a business associate must follow the HIPAA Security Rule, including a security risk analysis, safeguards for PHI, and security awareness training for its workforce, and must report breaches to the covered entity. Each Business Associate Agreement adds the covered entity's own terms on top. Stampwell covers the training, the policies, and the proof: your team trains for free, signs the policies on their phones, and the audit log holds the records your clients ask for.

Yes. The HIPAA Privacy and Security Rules require business associates to train their workforce members who handle PHI. This obligation is reinforced by every Business Associate Agreement. Since the HITECH Act (2009), HHS OCR can audit and fine business associates directly — not just covered entities. Penalties reach up to $2.19 million per violation category per year. Criminal violations can result in up to 10 years in federal prison.

Yes. Since the HITECH Act, a business associate is directly liable under HIPAA, not just through its clients. HHS OCR can investigate and fine a business associate on its own for failures under the Security Rule, such as no risk analysis, an untrained workforce, or an unreported breach, and for using PHI beyond what its BAA allows. Penalties reach up to $2.19 million per violation category per year.

The HITECH Act of 2009, put into effect by the HIPAA Omnibus Rule in 2013. Before that, a business associate answered only to its covered entity through the BAA. Since then, HHS OCR can investigate and penalize a business associate directly, and the Security Rule and Breach Notification Rule apply to it in full.

Yes. Since the HITECH Act extended HIPAA enforcement to business associates, HHS OCR has the authority to investigate and fine BAs independently — without going through the covered entity. OCR's audit program explicitly includes business associates. If your organization handles PHI and cannot produce training records, audit logs, or a signed BAA, you are exposed.

A Business Associate Agreement is a legally required contract between a covered entity and its business associate. It specifies how PHI may be used and disclosed, requires the BA to implement appropriate safeguards, and obligates the BA to report breaches to the covered entity. A covered entity that fails to have a signed BAA in place before sharing PHI with a vendor is itself in violation of HIPAA. Most BAAs explicitly require documented workforce HIPAA training.

Yes. Free forever, for up to 25 team members. No credit card required.

The list is broad. If your company provides services to a healthcare organization and those services involve any contact with PHI, you are likely a BA. This includes: medical billing and coding companies, health IT and EHR vendors, cloud storage and hosting providers, managed IT service providers and MSPs, legal and accounting firms that handle patient data, transcription services, shredding companies, answering services, claims processors, and consultants. When in doubt, the covered entity's legal team or your own counsel can confirm.

A business associate must notify the affected covered entity — or entities — without unreasonable delay and no later than 60 days after discovering the breach. The covered entity then takes responsibility for notifying affected individuals and, if large enough, HHS OCR and the media. However, OCR can also investigate and penalize the BA directly. Documented HIPAA training and written policies are among the first things OCR requests in a breach investigation.

HIPAA requires training for all new workforce members and retraining whenever policies, procedures, or relevant regulations change. Most business associates train annually to maintain audit-readiness and satisfy BAA obligations. Stampwell makes retraining your entire organization effortless — your team can complete it in minutes and your records update automatically.

Yes. Stampwell automatically logs everything your compliance program produces: every training completion, every signed policy and employee attestation, and every officer appointment, all timestamped. You can demonstrate compliance during an HHS OCR HIPAA audit or an OSHA inspection, and your records are always ready to download.

Yes. KnowQo is now Stampwell. We renamed the company in 2026. Same team, same software, same free tier. Anything you have read about KnowQo HIPAA compliance software describes Stampwell.