Who is a Business Association under HIPAA?

When is a Person or Entity a Business Associate Under HIPAA?

After languishing for more than two years, the HIPAA Omnibus Rule was finally released on January 17, 2013. The Final Rule updates the HIPAA Privacy and Security Rules to comply with the changes created to the Rules by the HITECH Act.

The HITECH Act made clear that Business Associates would be directly liable for data breaches. But, based on the comments HHS received, there appeared to be some confusion about who is a business associate for the purposes of HIPAA. In addressing a comment regarding human research, HHS provided the following helpful response:

A person or entity is a business associate only in cases where the person or entity is conducting a function or activity regulated by the HIPAA Rules on behalf of a covered entity, such as payment or health care operations, or providing one of the services listed in the definition of 'business associate,' and in the performance of such duties the person or entity has access to protected health information.

87 F.R. 5575 (Jan. 25, 2013) (emphasis added).

As such, whether an individual or entity is a business associate is a fact specific inquiry and all circumstances must be considered. Moreover, a person or entity can be a business associate when engaging in one activity but not a business associate when engaging in another. Consider the following example provided by HHS:

[A]n external researcher is not a business associate of a covered entity by virtue of its research activities, even if the covered entity has hired the researcher to perform the research. ...

However, a researcher may be a business associate if the researcher performs a function, activity, or service for a covered entity that does fall within the definition of business associate, such as the health care operations function of creating a de-identified or limited data set for the covered entity. See paragraph (6)(v) of the definition of ССhealth care operations.ТТ Where the researcher is also the intended recipient of the de-identified data or limited data set, the researcher must return or destroy the identifiers at the time the business associate relationship to create the data set terminates and the researcher now wishes to use the deidentified data or limited data set (subject to a data use agreement) for a research purpose.

87 F.R. 5575 (Jan. 25, 2013) (emphasis added).

To determine whether an individual or entity is a business associate, the tasks the individual or entity are undertaking must be reviewed carefully.

Resources:


	Home About Us Mission History Careers Contact Attorneys News & Insights Our Blogs Fraud & Abuse HIPAA Privacy & Security