{"page":"/blog/baa-vs-hipaa-authorization-ad-platforms","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Provision","What it says","Source"],"rows":[["45 CFR 160.103, business associate definition","The definition looks at work done on behalf of a covered entity and services that involve protected health information.","Source text"],["45 CFR 164.502(e)(1)–(2)","The rule calls for satisfactory assurances for business associate disclosures, documented in a written arrangement.","Source text"],["45 CFR 164.504(e)(2)","A business associate contract sets out uses, disclosures, safeguards and duties for the information it covers.","Source text"],["45 CFR 164.508(a)(3)","The marketing rule calls for authorization, with exceptions for face-to-face communications and gifts of nominal value.","Source text"],["45 CFR 164.508(a)(4), (c)","Sale-related authorizations require a remuneration statement, and the rule specifies core elements for authorizations.","Source text"]],"sourceUrls":[["https://www.law.cornell.edu/cfr/text/45/160.103"],["https://www.law.cornell.edu/cfr/text/45/164.502"],["https://www.law.cornell.edu/cfr/text/45/164.504"],["https://www.law.cornell.edu/cfr/text/45/164.508"],["https://www.law.cornell.edu/cfr/text/45/164.508"]]}