What if I'm a HIPAA business associate?

Review the privacy provisions of your BAAs to confirm that you are permitted to use PHI to communicate with individuals. Many BAAs implement HHS’s suggestion to permit the vendor business associate to use or disclose protected health information in order to provide services referenced in some other agreement, such as a Terms of Service. Be clear with your customers about how your product works and how you communicate with end users.