Each organization, with respect to a covered entity , that provides data transmission of protected health information to such entity (or its business associate) and that requires access on a routine basis to such protected health information , such as a Health Information Exchange Organization, Regional Health Information Organization, E-prescribing Gateway, or each vendor that contracts with a covered entity to allow that covered entity to offer a personal health record to patients as part of its electronic health record, is required to enter into a written contract (or other written arrangement) described in section 164.502(e)(2) of title 45, Code of Federal Regulations and a written contract (or other arrangement) described in section 164.308(b) of such title, with such entity and shall be treated as a business associate of the covered entity for purposes of the provisions of this subchapter and subparts C and E of part 164 of title 45, Code of Federal Regulations, as such provisions are in effect as of February 17, 2009 . ( Pub. L. 111–5, div. A, title XIII, § 13408 , Feb. 17, 2009 , 123 Stat. 271 .) Editorial Notes References in Text This subchapter, referred to in text, was in the original “this subtitle”, meaning subtitle D (§ 13400 et seq.) of title XIII of div. A of Pub. L. 111–5 , Feb. 17, 2009 , 123 Stat. 258 , which is classified principally to this subchapter. For complete classification of subtitle D to the Code, see Tables. Statutory Notes and Related Subsidiaries Effective Date Section effective 12 months after Feb. 17, 2009 , except as otherwise specifically provided, see section 13423 of Pub. L. 111–5 , set out as a note under section 17931 of this title .