What is a HIPAA business associate?

A business associate is a person or company that creates, receives, maintains or transmits protected health information for a covered entity. Members of the covered entity’s own workforce don’t count (45 CFR 160.103). In a medical practice, the practice is the covered entity, and an outside company that handles patient information for the practice, such as a billing company, is a business associate.

Who is a covered entity, and who is a business associate?

A covered entity is a health plan, a health care clearinghouse, or a health care provider that sends health information electronically in connection with a transaction HIPAA covers. Claims, eligibility checks and payment notices are among the transactions listed, so a practice that bills health plans electronically is in that third group.

A business associate works for the covered entity in one of two ways under 160.103. The first is handling protected health information for a function such as claims processing, billing, practice management, data analysis, utilization review or quality assurance. The second is providing legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial services where the work involves the covered entity disclosing that information to them. The definition also names health information organizations, e-prescribing gateways, and companies that offer personal health records for a covered entity.

Business associates can have their own vendors. A subcontractor that handles protected health information for a business associate is itself a business associate.

Who is not a business associate?

The definition excludes your own workforce. HIPAA’s workforce means employees, volunteers, trainees and others whose work is under your direct control, whether or not you pay them. A per-diem clinician whose work is under your direct control is workforce, and your workforce rules apply.

It also excludes a health care provider receiving information about a patient’s treatment. Sending records to a specialist for a referral doesn’t make the specialist your business associate.

What must the business associate contract say?

Under 164.502(e), you may share protected health information with a business associate only after getting “satisfactory assurance” that it will protect the information. You document that assurance in a written contract or other written arrangement that meets 164.504(e).

Section 164.504(e)(2) lists what the contract must do:

• set the uses and disclosures the business associate may make
• require appropriate safeguards and, for electronic information, compliance with the Security Rule
• require reports of uses or disclosures the contract doesn’t allow, including breaches of unsecured information
• require subcontractors to agree to the same restrictions
• require return or destruction of the information at the end, if feasible
• let you end the contract if the business associate violates a material term

For electronic information, 164.308(b) requires the written contract, and 164.314(a) requires it to say that the business associate will report any security incident it becomes aware of.

Does the Security Rule apply to the business associate itself?

Yes. Section 164.302 applies the Security Rule to covered entities and business associates alike. So the vendor must run its own safeguards, such as unique logins and audit controls, for the electronic information it holds. Under 164.308(b)(2), it must also get written assurances from its own subcontractors.

What stays with the practice?

Signing the contract doesn’t end your part. Under 164.504(e)(1)(ii), you have duties once you know of a pattern of activity or practice by the business associate that materially breaches the contract. You must take reasonable steps to fix the breach or end the violation. If that fails, you must end the contract where feasible. Otherwise you are out of compliance.

Access to your own systems also stays with you. When billing company staff sign in to your EHR or payer portals, they are users of your system. Section 164.304 defines a user as a person or entity with authorized access. Section 164.312(a)(2)(i) requires a unique name or number for each user, and 164.312(a)(1) limits access to people you have granted access rights. How to apply those rules is in HIPAA Security Rule access control requirements. For contractor oversight outside healthcare, see What is vendor oversight?