A Practice Note addressing the standards for cloud service providers as business associates under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This resource also analyzes how HIPAA's privacy, security, and breach notification rules apply to HIPAA covered entities (CEs) and business associates (BAs) in contracting with cloud service providers.