164.308(b)(2) Subcontractor Arrangements
Administrative safeguard · Provision
The requirement as we hold it
Subcontractor Arrangements. A business associate may permit a business associate that is a subcontractor to create, receive, maintain, or transmit electronic protected health information on its behalf only if the business associate obtains satisfactory assurances, in accordance with 164.314(a), that the subcontractor will appropriately safeguard the information.
The examiner asks
- Show me how a subcontractor of your business associate is bound to the same safeguards.
- Where is the flow-down recorded?
Evidence to bring
- the subcontractor assurance
- the flow-down clause
Source: 164.308(b)(2) at eCFR. Our statement of the clause, not the instrument verbatim.