HHS narrowed the "reasonable safeguards" language for covered entities using third-party cloud backup providers, requiring a documented Business Associate Agreement even for backup-only vendors that never actively process PHI.
Source log
- hhs.gov HIPAA guidance — Mar 2026