They can, but they are similarly bound to have audit records of access, restrict access to only those with a business need to the information, and most importan

They can, but they are similarly bound to have audit records of access, restrict access to only those with a business need to the information, and most importantly, BA's have a duty to notify of a breech. Prior to HITECH it was only the provider who was obligated to notify of a breech—business associates could do pretty much whatever they wanted as far as CMS was concerned, though the data sharing agreements oftentimes had more teeth to them than HIPAA itself.