Business Associates, Vendors, and Third-Party Arrangements
Who is a business associate
A business associate creates, receives, maintains, or transmits PHI on behalf of a covered entity or another business associate. Scope matters: a vendor with only incidental access, or one acting as a conduit that transports PHI with no more than transient storage, is not a business associate. Cloud storage, EHR hosting, billing, coding, transcription, accreditation, and legal or accounting services touching PHI generally are. Subcontractors of business associates are themselves business associates.
Required terms
Agreements must describe permitted and required uses, require appropriate safeguards, prohibit uses not permitted by the agreement or law, mandate subcontractor agreements, require breach reporting, provide for HHS access, require return or destruction of PHI at termination when feasible, and authorize termination for violation. Since HITECH, business associates carry direct obligations under the Security Rule and Breach Notification Rule and are contractually bound to privacy provisions.
Traps
Assuming a confidentiality clause substitutes for a business associate agreement; assuming the conduit exception covers a vendor that stores data persistently; assuming business associates owe nothing to individuals. Watch for group health plan plan-document arrangements, data aggregation, and disclosures to plan sponsors.
Rule of thumb
No agreement, no disclosure. Worked example: a vendor receiving patient email addresses to send a health-related newsletter is not covered by an agreement alone if the communication constitutes marketing - authorization is also required.