A "Business Associate" is a person or entity that performs certain functions or activities that involve the use or disclosure of protected health information for a Covered Entity.
Common Examples of Business Associates
Service providers that are typically Business Associates when accessing PHI include:
- Telehealth providers
- Answering services
- Companies involved in medical claims processing, (e.g., medical billing companies, collection agencies)
- Health information exchanges (HIEs), e-prescribing gateways
- Third party administrators and pharmacy benefit managers
- Utilization review and management companies
- Document storage or disposal (shredding) companies
- Patient safety or accreditation organizations
Examples of Entities that May Be Business Associates
The following are examples of service providers that are sometimes business associates, depending on the underlying relationships, whether they access PHI:
- Accounting firms
- Auditors
- Law firms
- Consulting firms
- Financial institutions (if engaging in accounts receivable or other functions extending beyond payment processing)
- Researchers (if performing HIPAA functions for a covered entity)
Common Examples of Entities That Are Not Usually Considered Business Associates
Not everybody who comes in contact with PHI is a Business Associate. Whether a Business Associate Agreement with a third party is needed depends solely on whether the third party is a person or entity performing Business Associate activities.
Typical examples of entities often not considered Business Associates include:
- Cleaning company
- Laboratories
- Telecommunications relay service providers for deaf or speech impaired patients or guardians
- Data storage companies with routine access to PHI
- Subcontractors of business associates
The Omnibus Rule expanded the definition of "business associates" to include data storage companies, entities that provide data transmission services if they require routine access to PHI, and subcontractors of business associates.
Disclaimer: This information is general in scope and educational in nature. It is not intended as legal advice. If you require legal advice, contact an attorney.
The recommendations in this publication do not indicate an exclusive course of treatment or serve as a standard of medical care. Variations, taking into account individual circumstances, may be appropriate. This content is for informational purposes only. It is not intended to constitute financial or legal advice. A financial advisor or attorney should be consulted if financial or legal advice is desired.
Last Updated
08/05/2021
Source
American Academy of Pediatrics