Business associates may receive PHI as long as the business associate provides satisfactory assurances that the PHI will be used only for the purpose for which the business associate was engaged.

Business associates often perform one or more of the following services: “Legal, actuarial accounting, consulting, data aggregation, management, administrative, accreditation, and financial.” In addition they include everyone who performs services for you of a type that involves doing anything on your behalf that involves receiving, using, or disclosing PHI, but is not a member of your workforce. This then covers your lawyer, accountant, billing service, or insurance consultant among other persons.

You must have a contract with each of your business associates which contains “satisfactory assurances” that the business associate will use the information only for the purposes for which the business associate was engaged by you, and will not make any use or disclosure of PHI that the regulations would prohibit you from making, as a “covered entity” under HIPAA. They must also assure contractually that they will safeguard the PHI from misuse and they will assist in your required management of PHI.

The JCAAI will provide you with sample business associate contracts in the near future, but you probably will need to consult with your own attorney in this area.

The rule on business associate contracts requires that any current contract that expired before April 14th, 2003, must be amended or replaced with a contract that contains HIPAA’s required provisions prior to April 14th, 2003. Existing contracts that were in place prior to October 15, 2002, and which were not renewed or modified between that date and April 14, 2003, were “deemed compliant” with HIPAA standards for an additional year, but were required to be amended or terminated with new agreements containing HIPAA’s required provisions by April 14th, 2004.

• Disclose PHI to business associates
• Lawyer, accountant, and others
• Requires satisfactory assurance
• Business associate will employ appropriate safeguards against improper use or disclosure
• Written Contract needed
• Restrict disclosure other than that permitted by law
• New contact needed by April 14, 2003 if current contract expires before April 14, 2003

NEXT>>