45 CFR § 164.504 - Uses and disclosures: Organizational requirements

Publisher

Cornell Law School Legal Information Institute

URL

https://www.law.cornell.edu/cfr/text/45/164.504

Published

unknown

Updated

unknown

Accessed

2026-09-24

HTTP status

200

License

US regulation text public domain; LII presentation; public domain text; excerpts permitted

Source notes citing this source

• A business associate contract must require the business associate to report to the covered entity any use or disclosure not provided for by the contract including breaches of unsecured PHI. in context
• A business associate contract must require return or destruction of all PHI at termination with no copies retained where feasible. in context
• A business associate contract must require the business associate to use appropriate safeguards and comply where applicable with the Security Rule (subpart C) for electronic PHI. in context
• A business associate contract must require the business associate to ensure that subcontractors handling PHI on its behalf agree to the same restrictions and conditions. in context
• 45 CFR 164.504(e)(2)(ii)(C) requires the business associate to report uses or disclosures not provided for by the contract, including breaches of unsecured PHI as required by 164.410. in context
• 45 CFR 164.504(e)(2)(ii)(J) requires the business associate, at termination, to return or destroy all PHI if feasible, or else extend the contract's protections to any PHI it retains. in context
• 45 CFR 164.504(e)(2)(ii)(I) requires the business associate to make its internal practices, books and records on PHI use and disclosure available to the HHS Secretary. in context
• 45 CFR 164.504(e)(2)(ii)(D) requires a business associate contract to ensure that subcontractors handling PHI agree to the same restrictions and conditions that apply to the business associate. in context
• 45 CFR 164.504(e)(2)(iii) requires the business associate contract to authorise the covered entity to terminate it if the business associate violates a material term. in context

Cite this source record

APA

WarmTransfer. (2026, September 24). 45 CFR § 164.504 - Uses and disclosures: Organizational requirements. WarmTransfer. https://warmtransfer.net/knowledge/sources/cornell-lii-45-cfr-164-504

BibTeX

@misc{warmtransfer-cornell-lii-45-cfr-164-504,
  title  = {45 CFR § 164.504 - Uses and disclosures: Organizational requirements},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sources/cornell-lii-45-cfr-164-504},
  note   = {Cornell Law School Legal Information Institute, accessed 2026-09-24}
}