A data subject company must also comply with the data protection rule, e.B. only make authorized disclosures to the business partner and allow individuals to exercise their rights under the rule. See 45 CFR 164.532(d) and (e). The problem for many covered companies is that they don`t always know who a HIPAA trade partnership agreement applies to. The Ministère de la Santé et des Services sociaux defines a business partner as “a person or entity that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of or provides services to a covered entity.” .