Medical equipment service companies handling equipment that holds PHIДЄccording to HHS, Covered Entities may only disclose PHI to an entity to help carry out its healthcare functions, not for the Business AssociateвЂ™s independent use or purposes.вЂќ 1 For example, a Business Associate/Subcontractor cannot use the PHI from the Covered Entity for its own email campaign.Consultants hired to conduct audits, perform coding reviews, etc.Potential Business Associates are people or companies like: As defined by the Health Information Portability and Accountability Act (HIPAA), a Business Associate is any organization or person working in association with or providing services to a Covered Entity who generates, handles, or discloses Protected Health Information (PHI). You need to be able to identify the classification of your workforce before you know what HIPAA requires. Understanding Who Your Business Associates and Business Associate Subcontractors Are Who are Your Business Associates? A signed agreement documents that the BA knows they must safely handle PHI. Once Covered Entities, Business Associates, and Business Associate Subcontractors have identified their relationship with one another, it is necessary to ensure that any third-parties will guard the PHI they receive. Require the Business Associate/Subcontractor to use appropriate safeguards to prevent inappropriate PHI use or disclosure.Provide that the Business Associate/Subcontractor will not use or further disclose PHI other than as permitted or required by the contract or as required by law.Describe the permitted and required PHI uses by the Business Associate/Subcontractor.The Business Associate/Subcontractor Agreement must include the following information, according to HHS: ItвЂ™s in both of your best interests to have an agreement since all three classifications are responsible for protecting PHI. This means that organizations must have a Business Associate Agreement (BAA) for all three levels in order to meet the requirements of HIPAA. HHS can audit BAs and Subcontractors for HIPAA compliance, not just Covered Entities. These assurances have to be in writing in the form of a contract or other agreement between the Covered Entity and the BA. HIPAA requires Covered Entities to only work with Business Associates who assure complete protection of PHI. Before we break down the details ofВ classifying your vendors, take a look at this infographic to get an understanding of the differences among Covered Entities, Business Associates, and Business Associate Subcontractors.ДЄ Business Associate Contract, or Business Associate Agreement, is a written arrangement that specifies each partyвЂ™s responsibilities when it comes to PHI.

This week, we discuss the requirements of a BA and BAS and the specifics of a Business Associate Agreement (BAA). Who is a Business Associate or a Business Associate Subcontractor and what needs to be in the agreement between these businesses? Hiring outside help when you need extra hands or have special needs often makes good business sense. Therefore, it is in the Covered EntityвЂ™s and the BAвЂ™s best interest to maintain a thorough understanding of their relationship and how they expect one another to secure patient, client, or employee data.Д«ut letвЂ™s face it, running a business without any help from third parties is difficult, if not impossible. The HIPAA Omnibus Rule changed how BAs and Business Associate Subcontractors (BAS) can be held liable for potential HIPAA violations. The HIPAA Privacy Rule requires all Covered Entities to have a signed Business Associate Agreement (BAA) with any Business Associate (BA) they hire that may come in contact with PHI.

Phi stands for