Nearly every cloud service that touches electronic protected health information is a HIPAA business associate, and the U.S. Department of Health and Human Services buried the comfortable myth that a vendor who only stores encrypted data, or never looks at it, escapes the rules. This guide maps who counts as a covered entity, a business associate, and a subcontractor, and why the conduit exception almost never rescues a cloud provider. It reads 45 C.F.R. 164.504(e) clause by clause to show exactly what a compliant business associate agreement must contain, then walks the Privacy, Security, and Breach Notification Rules as they land on a shared cloud stack. It explains the encryption safe harbor that converts many data-loss events into non-events, the shared-responsibility line that decides who pays after a breach, and the OCR enforcement machinery, tiered penalties, and 30-day cure window behind it all. It closes with the sweeping 2024-2025 Security Rule proposal, the hard problem of feeding PHI into AI and analytics, offshore storage, and a working compliance checklist a hospital administrator, a SaaS founder, a privacy lawyer, and a curious patient can all follow.