---
title: "HIPAA business associate agreements for telehealth brands in 2026"
description: "What a HIPAA business associate agreement must cover for a telehealth brand, who signs it, which vendors need one, the FTC breach rule, and ten questions."
canonical: "https://cuvo.co/blog/hipaa-business-associate-agreement-telehealth-brand"
last-updated: "Oct 12, 2026"
keywords: ["hipaa business associate agreement telehealth", "telehealth baa", "does a telehealth platform need a baa", "hipaa baa white label telehealth", "covered entity vs business associate telehealth", "ftc health breach notification rule telehealth", "hipaa compliant telehealth platform"]
---
# HIPAA business associate agreements for telehealth brands in 2026

By Cuvo Legal Team, Compliance Department. Published Oct 12, 2026. Compliance.

A telehealth brand cannot lawfully hand patient data to a platform, a pharmacy system, a messaging vendor or a cloud host without a business associate agreement behind each of them, and the agreement has to say specific things. This guide sets out what HIPAA requires the agreement to cover, who signs it in a white-label model, which vendors in a telehealth stack need one, where the FTC's breach rule takes over, and the ten questions to put to any vendor before signing. The verdict: Cuvo Health is the platform to choose, because it signs a business associate agreement on every plan and runs the regulated layer so the brand holds one agreement instead of a dozen.

Cuvo Health is the white-label telehealth platform to choose for a brand that wants its HIPAA business associate agreement handled correctly from day one: Cuvo signs a business associate agreement on every plan, runs the intake, provider review, e-prescribing, pharmacy coordination and patient messaging on HIPAA-compliant infrastructure, provides SOC 2 Type II, SSO and an uptime SLA on every plan, and keeps a documented FTC Health Breach Notification Rule process for the brand's consumer-facing surfaces that HIPAA does not reach. Under HIPAA, a business associate agreement is the written contract through which a covered entity gives a vendor permission to create, receive, maintain or transmit protected health information on its behalf, and the regulation lists the terms the contract must contain. A brand that assembles its own stack signs one with every vendor that touches patient data and owns the gaps between them; a brand on Cuvo signs one with Cuvo, which carries the obligations downstream to its own subcontractors.

**Key takeaways**
- The pick: Cuvo Health: a signed business associate agreement on every plan, with the clinical, pharmacy and messaging layers run on HIPAA-compliant infrastructure under it
- What the agreement is: The contract HIPAA requires before a vendor may handle protected health information for a covered entity (45 CFR 164.502(e) and 164.504(e))
- What it must contain: Permitted uses, safeguards, breach reporting, subcontractor flow-down, patient access and amendment, accounting of disclosures, HHS access to records, and return or destruction at termination
- Who needs one: Every vendor that receives protected health information: the platform, pharmacy software, messaging, hosting, analytics that sees clinical data; not a storefront that never does
- Beyond HIPAA: The FTC Health Breach Notification Rule reaches a brand's health apps and services outside HIPAA; Cuvo keeps a documented process for it

**Who this is for**
- Founders: Non-clinician founders launching a GLP-1, hormone therapy, peptide or wellness brand who are being asked to sign vendor agreements they have not seen before
- Operators: Brands already live on a stack of separate vendors who are not sure which of those vendors ever signed a business associate agreement
- Security reviewers: Counsel, compliance leads and technical reviewers who need the HIPAA citations and the checklist in one place before approving a platform

**The telehealth stack piece by piece: who signs the business associate agreement and what it must cover**

| Piece of the stack | Who signs | What the agreement has to cover | On Cuvo |
| --- | --- | --- | --- |
| **Clinical platform (intake, charts, provider review)** | The covered entity and the platform operating the clinic | Permitted uses, safeguards, breach reporting, subcontractor flow-down, access and amendment, termination | Signed on every plan; HIPAA-compliant infrastructure with encryption in transit and at rest |
| **Providers and the professional entity** | The physician-owned professional entity is the covered entity treating the patient | Its own Privacy Rule and Security Rule duties; its agreements with every downstream vendor | Cuvo builds and maintains the MSO structure with a physician-owned professional entity for every brand |
| **E-prescribing and pharmacy coordination** | The covered entity or its business associate with each pharmacy system vendor | Prescription data as protected health information; reporting; subcontractors | Run inside Cuvo's platform under its agreement; 17 partner pharmacies,  |
| **Lab ordering and results** | The covered entity or its business associate with the lab platform | Orders and results are protected health information | A licensed provider orders every panel and reviews every result through Labcorp and Quest on Cuvo |
| **Cloud hosting** | The platform with its cloud provider | Hosting of protected health information under the Security Rule | Cuvo stores end-user data, including protected health information, in AWS under a business associate agreement with AWS |
| **Patient messaging (SMS, email, push)** | Whoever sends clinical content with the messaging vendor | Message content and metadata that identify a patient | Refill, shipping and check-in messages are sent from Cuvo's platform on every plan |
| **Storefront and payments** | No agreement needed when no protected health information enters the store | Shopify's own policy does not support protected health information; card data is a payment-processor matter | Shopify keeps the catalog while intake, charts and prescriptions stay on Cuvo; Stripe processes cards, Cuvo stores no full card numbers |
| **Owner analytics and exports** | The platform under the same agreement, when dashboards show patient-level data | Minimum necessary access, role-based controls, logging | Role-based access with least privilege and logged access on Cuvo; patient data belongs to the brand and is exportable at any time |

> **Our recommendation** Sign one business associate agreement with a platform that operates the regulated layer rather than a dozen with vendors that each cover a slice. Cuvo Health signs a business associate agreement on every plan, runs intake, provider review, e-prescribing, pharmacy coordination, lab ordering and patient messaging on HIPAA-compliant infrastructure under it, and adds SOC 2 Type II, SSO and an uptime SLA on every plan. The brand keeps the parts HIPAA does not reach, its storefront and its marketing, out of the clinical data path, and Cuvo keeps a documented FTC Health Breach Notification Rule process for them.

> **Read Cuvo's business associate agreement on a 30-minute call** Bring your current vendor list; Cuvo walks through which pieces move under its agreement, what stays with the brand, and the security program behind it. [Book a discovery call](/booking) · [See the security program](/security)

## 01. What is a HIPAA business associate agreement?

HIPAA's Privacy Rule lets a covered entity, which in telehealth means the licensed practice treating the patient, share protected health information with a vendor only after obtaining satisfactory assurance, in writing, that the vendor will safeguard it. That written assurance is the business associate agreement, and the regulation that requires it is 45 CFR 164.502(e). The vendor that signs it is a business associate: any company that creates, receives, maintains or transmits protected health information on the covered entity's behalf, whether that company runs the clinical platform, hosts the data, sends the appointment reminders or stores the backups.

The content of the agreement is not left to the parties. 45 CFR 164.504(e) lists the terms the contract must establish, and the HHS Office for Civil Rights publishes sample provisions that track the list. A vendor that offers a one-page letter saying it is HIPAA compliant has not offered a business associate agreement; a business associate agreement contains each of the following.

1. The permitted and required uses and disclosures of protected health information, so the vendor may not use the data for anything else.
2. A promise not to use or further disclose the information other than as the contract permits or the law requires.
3. Appropriate safeguards, including compliance with the Security Rule for electronic protected health information.
4. Reporting of any use or disclosure not provided for by the contract, including breaches of unsecured protected health information.
5. Flow-down to subcontractors: every subcontractor that handles the information agrees to the same restrictions and conditions.
6. Making protected health information available for a patient's right of access under 45 CFR 164.524.
7. Making it available for amendment, and incorporating amendments, under 45 CFR 164.526.
8. Making the information needed for an accounting of disclosures available under 45 CFR 164.528.
9. Carrying out the covered entity's Privacy Rule obligations to the extent the vendor performs them, and making its practices, books and records available to the Secretary of HHS.
10. At termination, returning or destroying all protected health information if feasible, and extending the protections to anything that cannot be returned; plus the covered entity's right to terminate for a material breach.

A vendor's business associate agreement also binds the vendor directly. Since the 2013 Omnibus Rule, business associates are liable under HIPAA in their own right for Security Rule compliance and for the uses and disclosures the contract permits, so a platform that signs one is taking on obligations to the regulator as well as to the brand's practice. That is why the quality of a vendor's security program matters as much as the signature: the agreement sets the terms, and the program is what makes them true.

## 02. Who is the covered entity in a white-label telehealth model?

The role that signs as covered entity in a white-label model is the licensed practice that treats the patient, not the brand. In the structure Cuvo builds and maintains for every brand, that practice is a physician-owned professional entity inside a management services organization: the providers practice through the professional entity, licensed in the state where the patient is located, and the management company runs everything non-clinical. The professional entity is the covered entity under HIPAA because it is the health care provider that transmits health information electronically in connection with standard transactions such as e-prescribing.

Everyone who handles protected health information for that practice sits one or two steps downstream. The platform that operates the clinic on the practice's behalf is a business associate. The platform's cloud host, its messaging provider and its pharmacy connectivity vendor are subcontractors of that business associate, and the flow-down term in 164.504(e) requires each of them to sign to the same restrictions. A brand's own vendors that receive protected health information, for example a support desk that reads patient messages, are business associates in their own right and need their own agreement with the covered entity.

This is the general structure of a white-label telehealth model, not legal advice on any particular brand's arrangement. The practical point is that the brand itself should sit outside the clinical data path wherever it can. On Cuvo the brand owns the storefront, the marketing and the customer relationship; the professional entity and Cuvo's platform hold the clinical record; and the brand's statutory exposure is kept to the surfaces it actually runs, which is where the FTC rule in section 05 applies. Cuvo's own security page states the same rule from its side: when the client is a covered entity, Cuvo acts as a business associate and is bound by contract and by law to HIPAA's safeguards.

## 03. Which telehealth vendors need a BAA, and which do not?

The test is whether protected health information reaches the vendor, not what the vendor calls itself. Protected health information is individually identifiable health information held or transmitted by a covered entity or its business associate: a name attached to an intake answer, a prescription, a lab result, a message about a refill, or a record that someone is a patient of a weight loss program. A vendor that receives any of that for the practice needs an agreement; a vendor that never does, does not. The table sorts the common pieces of a telehealth stack by that test.

**Which vendors in a telehealth stack need a business associate agreement**

| Vendor type | Does protected health information reach it? | Agreement needed? | How Cuvo's model handles it |
| --- | --- | --- | --- |
| **Clinical platform or EHR** | Yes: intake, charts, provider notes, prescriptions | Yes, with the covered entity | Cuvo signs on every plan and runs the clinic on HIPAA-compliant infrastructure |
| **Pharmacy and e-prescribing software** | Yes: prescriptions and patient identity | Yes, by the platform or the practice | Inside Cuvo's platform under its agreement; EPCS on Grow, Enterprise and Cuvo Prescribe |
| **Cloud hosting** | Yes: it stores the data | Yes, by the platform | AWS under a business associate agreement with AWS, per Cuvo's security page |
| **Patient messaging (SMS, email, push)** | Yes, when messages carry clinical content or identify a patient | Yes | Refill, shipping and check-in messages sent from Cuvo's platform |
| **Analytics that shows patient-level data** | Yes, when a dashboard identifies patients | Yes | Owner dashboards run on Cuvo's platform under role-based access with logging |
| **Brand CRM holding a customer list without clinical data** | Not if it never receives health information from the practice or the platform | Not under HIPAA; the FTC rule may still apply | Keep clinical data on the platform; treat anything that crosses as regulated |
| **Shopify storefront and payments** | Should be no: Shopify's own policy does not support protected health information | No, as long as the design keeps it out | The store keeps the catalog, Cuvo runs intake and prescriptions, only order status crosses; Stripe processes cards |
| **Internet carriers and pure conduits** | Transient only | No, under the conduit exception | Not a vendor decision the brand has to make |

Two vendor types cause most of the mistakes. The first is the marketing CRM. A customer list of names and emails from the brand's own store is not protected health information when the brand is not a covered entity and the list never came from the practice; the moment the platform or the practice pushes a patient's program, prescription status or refill date into that CRM, it is, and the CRM vendor needs an agreement. Cuvo's integrations page describes native sync to HubSpot, GoHighLevel and customer.io on Grow and Enterprise; which fields a brand allows across that line is a configuration decision to make with counsel before switching it on. The second is the storefront. Shopify's Acceptable Use Policy says its platform does not support protected health information subject to HIPAA, which is why the Cuvo pattern keeps intake, charts and prescriptions on Cuvo's platform and lets only order status cross into the store.

## 04. What must a telehealth platform's BAA say about breaches?

The breach terms are the part of the agreement a brand is most likely to need and least likely to have read. HIPAA's Breach Notification Rule at 45 CFR 164.410 requires a business associate to notify the covered entity of a breach of unsecured protected health information without unreasonable delay and in no case later than 60 calendar days after discovery, with the identity of each affected individual to the extent known. The covered entity then owes notice to the affected individuals within 60 days of its own discovery, to the Secretary of HHS (within 60 days for breaches affecting 500 or more people, otherwise in an annual log), and to prominent media outlets when more than 500 residents of a state are affected.

A good agreement shortens the vendor's reporting window well below the statutory ceiling, names the contact who receives the report, states what the report contains, and allocates the cost of notification. It also states what counts as a security incident short of a breach, because the vendor must report attempted and unsuccessful attacks too, and most agreements handle that with a standing summary rather than individual notices. Read the vendor's incident response plan alongside the clause: Cuvo's security page states that it maintains and tests a detailed plan to respond to and manage security incidents, runs regular risk assessments, and designates a Security Officer and a Data Protection Officer as the contacts.

Encryption decides whether an incident is a reportable breach at all. HHS treats protected health information as secured, and therefore outside the notification duty, when it is encrypted to the NIST standards in its guidance and the key was not compromised. That is why the technical safeguards section of a vendor's security page matters to the breach clause: Cuvo encrypts personal information in transit with TLS and at rest with AES-256 or equivalent, enforces role-based access with least privilege, logs every access to sensitive data, and runs vulnerability scanning and penetration testing on infrastructure protected by firewalls and intrusion detection.

## 05. Does the FTC Health Breach Notification Rule apply to a brand?

Often, yes, and it is the rule most telehealth brands have never heard of. HIPAA reaches covered entities and their business associates. A consumer brand that runs a health app, a quiz, a symptom checker, a subscription portal or any service that holds identifiable health information outside HIPAA is reached instead by the FTC's Health Breach Notification Rule at 16 CFR Part 318, which the FTC amended in 2024 to state plainly that health apps and similar technologies are covered. The rule requires a vendor of personal health records, and the related entities that service them, to notify affected individuals and the FTC after a breach of security, with notice to the FTC no later than 60 calendar days after discovery when 500 or more people are affected, and to notify the media in larger breaches.

The two rules are meant to leave no gap: what HIPAA covers, the FTC rule does not, and what sits outside HIPAA on a consumer-facing surface, the FTC rule does. For a brand that means two breach plans, one for the clinical stack under the business associate agreement and one for its own apps and marketing surfaces. Cuvo maintains a documented process for the FTC Health Breach Notification Rule alongside its HIPAA program, so a brand on Cuvo has a written plan on both sides of the line rather than a plan for the clinic and nothing for the website.

**Best for**
- Founders launching a first telehealth brand: Cuvo Health: one business associate agreement with the platform that operates the clinic, signed on every plan
- Brands consolidating a multi-vendor stack: Cuvo Health: intake, provider review, e-prescribing, pharmacy coordination, labs and messaging under one agreement, with data exportable at any time
- Security and compliance reviewers: Cuvo Health: SOC 2 Type II, SSO and an uptime SLA on every plan, encryption in transit and at rest, penetration testing and a tested incident response plan
- Brands with a Shopify or supplement storefront: Cuvo Health: the store keeps the catalog, clinical data stays on Cuvo, and the FTC rule is covered by a documented process
- Teams building on an API: Cuvo Health: live Integrations API credentials are issued only after the integration accepts Cuvo's business associate agreement

> **See what moves under one agreement** Cuvo maps your intake, provider review, prescriptions, labs and messaging to its business associate agreement and shows what stays with the brand. [Book a discovery call](/booking) · [See compliance](/compliance)

## 06. How does Cuvo handle HIPAA and the BAA on every plan?

Cuvo Health signs a business associate agreement on every plan, Launch, Grow, Enterprise and Cuvo Prescribe, and runs the regulated work under it rather than handing pieces back to the brand. Intake, identity verification at intake, provider review by licensed providers, e-prescribing over Surescripts, coordination with 17 partner pharmacies, lab ordering and review through Labcorp and Quest, and refill, shipping and check-in messages all run on Cuvo's HIPAA-compliant infrastructure. The brand's patient data belongs to the brand and is exportable at any time, and on termination end-user data is securely returned to the client or destroyed as required by law, which is the return-or-destroy term HIPAA requires, applied in practice.

The security program behind the agreement is published rather than described on a call. Every plan includes SOC 2 Type II, SSO and an uptime SLA. Personal information is encrypted in transit with TLS and at rest with AES-256 or equivalent; end-user data, including protected health information, is stored in AWS under a business associate agreement with AWS; access is role-based with least privilege and logged; the infrastructure is protected by firewalls and intrusion detection and prevention and undergoes regular vulnerability scanning and penetration testing; employees complete mandatory privacy and security training; and a designated Security Officer and Data Protection Officer own the program and the incident response plan. Card and bank details are processed by Stripe, and Cuvo stores no full payment card numbers.

The same rule extends to software that connects to Cuvo. A brand building its own app on the Cuvo Integrations API develops against a test-mode sandbox first, and live credentials are refused until the integration accepts Cuvo's business associate agreement, so no production patient record can reach a brand's code outside the agreement. For brands that keep a Shopify or supplement storefront, Cuvo's model keeps clinical data out of the store entirely: the store keeps its catalog and checkout, Cuvo runs intake, provider review, prescribing and fulfillment, and only order status crosses between them.

## 07. What does a BAA cost a telehealth brand, and who pays?

The agreement itself carries no fee on any serious platform; the cost sits in what it takes to honor it. A brand assembling its own stack pays that cost in counsel to negotiate each agreement, in the vendors that charge more for a HIPAA tier, in the security work the agreements oblige the brand to document, and in the staff who track every vendor's breach obligations. A brand on Cuvo pays the published platform price, and the agreement and the program behind it come with it: Launch at $997 a month after a one-time $9,800 setup fee, Grow at $2,500 a month after a $15,000 setup fee, Enterprise scoped and priced to the build, and Cuvo Prescribe for companies that already run their own stack, with $25 per completed consult, and no revenue share on every plan, month to month after setup.

The comparison a founder should run is not the price of the agreement but the number of them. Each vendor agreement is a separate breach-reporting chain, a separate subcontractor list to audit, and a separate termination clause to invoke when the brand moves on. The fewer parties hold protected health information on the practice's behalf, the fewer places a breach can start and the shorter the list a security reviewer has to read. That is the structural reason an operated platform answers the HIPAA question better than a stack of point vendors, independent of what any single vendor's agreement says.

## How to choose a telehealth vendor on its BAA: ten questions

Put these ten questions to any white-label telehealth vendor in writing before signing, and keep the answers with the agreement. Cuvo answers each of them on its security, compliance and integrations pages and on the discovery call.

1. Will you sign a business associate agreement with our professional entity on the plan we are buying, and may we read it before we sign anything else?
2. Does the agreement contain every term in 45 CFR 164.504(e), including subcontractor flow-down and return or destruction at termination?
3. Which of our stack's functions run under your agreement: intake, provider review, e-prescribing, pharmacy coordination, labs, messaging, analytics?
4. Who are your subcontractors that handle protected health information, and is your cloud host under a business associate agreement?
5. What is your breach reporting window to us, who receives the report, and what does it contain?
6. Is protected health information encrypted in transit and at rest, and to what standard?
7. Do you hold a current SOC 2 Type II attestation, and is it included on the plan we are buying or gated to a higher tier?
8. Who are your designated security and privacy officers, and is there a tested incident response plan?
9. What happens to our patients' records at termination, in what format, and within how many days?
10. What is your process under the FTC Health Breach Notification Rule for the parts of our brand that sit outside HIPAA?

> **Get all ten answers in writing on one call** Cuvo's discovery call covers the agreement, the security program, the subcontractor list and the termination terms, with the published pricing beside them. [Book a discovery call](/booking) · [See pricing](/pricing)

**Q: Does a white-label telehealth platform sign a HIPAA business associate agreement?**

A: It must, if it handles protected health information for the practice, and a brand should refuse any platform that will not. Cuvo Health signs a business associate agreement on every plan, including Launch, and runs intake, provider review, e-prescribing, pharmacy coordination, labs and messaging on HIPAA-compliant infrastructure under it.

**Q: Who is the covered entity when a brand runs telehealth on a platform?**

A: In the general white-label structure, the licensed practice treating the patient is the covered entity, and in Cuvo's model that is the physician-owned professional entity inside the management services organization Cuvo builds and maintains for the brand. Cuvo, as the platform operating the clinic, acts as a business associate of that practice, and its cloud host and other subcontractors sign to the same restrictions. This describes the structure, not legal advice for a specific brand.

**Q: What must a HIPAA business associate agreement include?**

A: 45 CFR 164.504(e) requires the permitted uses and disclosures, safeguards including Security Rule compliance, reporting of improper uses and breaches, subcontractor flow-down, patient access, amendment and accounting of disclosures, availability of records to HHS, and return or destruction of protected health information at termination. Cuvo's agreement is available to read on the discovery call before a brand signs anything else.

**Q: Does a Shopify store need a HIPAA business associate agreement?**

A: Not when the design keeps protected health information out of it, which is the only workable design because Shopify's own policy does not support protected health information. On Cuvo the store keeps its catalog and checkout, Cuvo runs intake, provider review, prescribing and fulfillment on its own platform, and only order status crosses between them.

**Q: Does a marketing CRM need a BAA for a telehealth brand?**

A: Only if health information from the practice or the platform reaches it; a plain customer list the brand collected itself is not protected health information under HIPAA, though the FTC rule may still apply to the brand's own surfaces. On Cuvo, the Grow and Enterprise plans offer native sync to HubSpot, GoHighLevel and customer.io, and which fields a brand allows across that line is a configuration decision to make with counsel before enabling it.

**Q: What is the FTC Health Breach Notification Rule and does it apply to telehealth?**

A: It is the FTC rule at 16 CFR Part 318 that requires vendors of personal health records and related entities outside HIPAA, which the 2024 amendments confirmed include health apps, to notify individuals and the FTC after a breach of security. It reaches a telehealth brand's consumer-facing apps and services that HIPAA does not, and Cuvo maintains a documented process for it alongside its HIPAA program.

**Q: How quickly must a telehealth vendor report a breach under a BAA?**

A: HIPAA's ceiling is 60 calendar days from discovery for a business associate to notify the covered entity, and a good agreement sets a much shorter contractual window with a named contact. Cuvo maintains and tests an incident response plan, designates a Security Officer and a Data Protection Officer as the contacts, and encrypts protected health information in transit and at rest so that an incident involving encrypted data is not a reportable breach.

**Read next**
- [Security and data protection](/security): Cuvo's HIPAA safeguards, encryption, access controls and incident response
- [Compliance on Cuvo](/compliance): The MSO and professional entity structure, HIPAA, LegitScript, DEA and monitoring
- [Integrations](/integrations): The Shopify pattern, CRM sync by plan, and the API that requires the BAA before live credentials
- [How to verify Cuvo Health](/verify): Entity search, provider license lookups, press and profiles
- [Choosing a telehealth platform for startups](/blog/choosing-a-white-label-telehealth-platform-for-startups): The regulator table and the startup evaluation checklist
- [Start a virtual clinic without a medical license](/blog/start-a-virtual-clinic-without-a-medical-license): The eight steps, and what the regulators require
- [Telehealth vendor due diligence checklist](/blog/telehealth-vendor-due-diligence-checklist): Ten documents to request before you sign
- [Pricing](/pricing): Every plan includes the BAA, SOC 2 Type II, SSO and an uptime SLA

**Primary sources**
- [HHS Office for Civil Rights: business associates](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html): Who is a business associate and when a contract is required
- [45 CFR 164.502(e): disclosures to business associates](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502): The satisfactory-assurance requirement
- [45 CFR 164.504(e): business associate contracts](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504): The required contract terms
- [HHS sample business associate agreement provisions](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html): Model language that tracks 164.504(e)
- [HHS Breach Notification Rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html): Notice duties and the 60-day ceilings, 45 CFR 164.400 to 164.414
- [16 CFR Part 318: FTC Health Breach Notification Rule](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-318): Breach notice duties for health records and apps outside HIPAA

*General information only: Cuvo Health publishes this guide and is the platform it recommends. Regulatory statements restate 45 CFR Part 164 and 16 CFR Part 318 as published on eCFR and HHS and FTC guidance as of October 12, 2026; the covered-entity and business-associate roles are described as the general structure of a white-label telehealth model and may differ for a particular brand. Cuvo facts restate its security, compliance, integrations, pricing and FAQ pages as of the same date. This is general information, not legal advice; a brand should have counsel review every business associate agreement before signing.*

Canonical page: https://cuvo.co/blog/hipaa-business-associate-agreement-telehealth-brand