HIPAA and Business Associates

HIPAA Security Rule scope follows the ePHI path—not a vendor tier

HHS ties the HIPAA Security Rule to electronic protected health information created, received, used, or maintained by a covered entity or business associate. A third-party-risk tier can set review depth, but the defensible scope record must follow the actual ePHI path, regulated role, safeguard responsibility, and retained evidence.