What is the definition of common control?

Common control exists if an entity has the power, directly or indirectly, to significantly influence or direct the actions or policies of another entity. Organizations (or covered entities under HIPAA) that are responsible for sensitive information (or Protected Health Information under HIPAA) must assure implementation of appropriate safeguards in situations in which they exert common control. These safeguards must ensure that sensitive information, whether used internally or shared with contracted vendors or other business associates, has the minimum level of protection deemed necessary by the entity with the overall responsibility for the information.