--- title: "42 U.S.C. 17934 HIPAA: Application of privacy provisions and penalties to business associates of covered entities" canonical: "https://dposchool.com/hipaa/section/17934" source: "https://uscode.house.gov/us/usc/119-136/t42/s17934/" source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-22" language: "en" publisher: "DPO School" --- 42 U.S.C. 17934 HIPAA · Chapter 156: HEALTH INFORMATION TECHNOLOGY # 42 U.S.C. 17934 HIPAA: Application of privacy provisions and penalties to business associates of covered entities United States Code, current through Public Law 119-136 (October 22, 2026). Retrieved 30 October 2026. ## Official text ### 42 U.S.C. 17934(a) **(a)** Application of contract requirements In the case of a business associate of a covered entity that obtains or creates protected health information pursuant to a written contract (or other written arrangement) described in section 164.502(e)(2) of title 45, Code of Federal Regulations, with such covered entity, the business associate may use and disclose such protected health information only if such use or disclosure, respectively, is in compliance with each applicable requirement of section 164.504(e) of such title. The additional requirements of this subchapter that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to such a business associate and shall be incorporated into the business associate agreement between the business associate and the covered entity. ### 42 U.S.C. 17934(b) **(b)** Application of knowledge elements associated with contracts Section 164.504(e)(1)(ii) of title 45, Code of Federal Regulations, shall apply to a business associate described in subsection (a), with respect to compliance with such subsection, in the same manner that such section applies to a covered entity, with respect to compliance with the standards in sections 164.502(e) and 164.504(e) of such title, except that in applying such section 164.504(e)(1)(ii) each reference to the business associate, with respect to a contract, shall be treated as a reference to the covered entity involved in such contract. ### 42 U.S.C. 17934(c) **(c)** Application of civil and criminal penalties In the case of a business associate that violates any provision of subsection (a) or (b), the provisions of sections 1176 and 1177 of the Social Security Act (42 U.S.C. 1320d–5, 1320d–6) shall apply to the business associate with respect to such violation in the same manner as such provisions apply to a person who violates a provision of part C of title XI of such Act \[42 U.S.C. 1320d et seq.\]. ## Source Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source credit: ( Pub. L. 111-5, div. A, title XIII, § 13404 , Feb. 17, 2009 , 123 Stat. 264 .) [42 U.S.C. 17934 on the Office of the Law Revision Counsel](https://uscode.house.gov/us/usc/119-136/t42/s17934/) United States Code, current through Public Law 119-136 (October 22, 2026). Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [HIPAA Navigator](https://dposchool.com/hipaa) / 42 U.S.C. 17934 Previous: [42 U.S.C. 17933 HIPAA: Education on health information privacy](https://dposchool.com/hipaa/section/17933) Next: [42 U.S.C. 17935 HIPAA: Restrictions on certain disclosures and sales of health information; accounting of certain protected health information disclosures; access to certain information in electronic format](https://dposchool.com/hipaa/section/17935) ## For AI agents - Machine-readable index: https://dposchool.com/hipaa/llms.txt - JSON API: https://dposchool.com/hipaa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents