# Presentation: 683187

## HIPAA Administrative Simplification -

*Fulton County Department of Health and Wellness**November 10, 2005*

*HIPAA Administrative Simplification -*
*Business Associates and Agreements*

- HEALTHY COMMUNITIES
- ACCESS PROGRAM
- NEW GRANTEE ORIENTATION
- HCAP 2005

## Applicability - Covered Entities

**Health plans**
**Providers***
**Healthcare****clearinghouses**

- Health insurers
- HMOs
- ERISA plans
- Medicare+Choice
- Long Term Care Insurer
- Indian Health Service
- Physicians
- Hospitals
- Laboratories
- Pharmacies/PBM

- Veteran’s Administration
- Active military
- CHAMPUS
- Medicaid and Medicare
- Medicare supplements
- FEHBP, CHIPs
- Ambulatory care centers
- Dentists
- DME suppliers
- Home care agencies

- Receive non-standard data or transactions from covered entities for conversion into standard data or transactions

- *Transmitting health information electronically in standard transactions

## IIHI and PHI

- Individually Identifiable Health Information
- Health information created or maintained by a covered entity or employer that identifies or can be used to identify a specific individual
- Relates to individual’s health, health care or payment for care - past, present or future
- Information in any medium – written, spoken, faxed, electronic, paper
- Includes clinical, claims, enrollment and demographic information
- Includes information in standard transactions defined by HIPAA
- Protected Health Information
- IIHI transmitted or maintained in any electronic or other medium, with the exception of certain educational records (FERPA)

## Uses and Disclosures

- “Uses” are internal to entity
- “Disclosures” are external, made to other entities; includes providing  access to PHI
- To use or disclose PHI, covered entity must have legal basis:
- Treatment, payment or operations (consent)
- Authorization
- Permitted without authorization or required by law
- With opportunity to agree or object** **
- Legal basis gives covered entity the right to use or disclose PHI

## Business Associates

- Definition (two-part test):
- A contractor who receives PHI from a covered entity, its business associate or an organized health care arrangement
- For the purpose of assisting with or performing a function for or on behalf of that covered entity (or organized health care arrangement)
- BA relationship exists when the BA performs a function that the covered entity could perform for itself. Guideline:
- Includes: administrative, management, financial
- Generally excludes: services requiring licensure; but note that legal and accounting services are BA services
- Business associate status
- Unlike covered entity status, BA status is relative
- Determined by context of relationship with each covered entity

## Kinds of Business Associates

- Examples of business associates:
- Entities providing legal, actuarial, accounting, consulting, management, administrative, accreditation, data aggregation, or financial services
- Document management or shredding services
- Intermediary organizations, e.g. IPAs, medical groups, PHOs, PBMs, TPAs for covered group health plans
- Health care clearinghouses
- External review entities
- A covered entity may be business associate of another covered entity
- Not considered business associates
- Common carriers (US mail, express services)
- Covered entity employees
- Financial institutions
- Employers who sponsor covered group health plans

## What They Are Not...

- Business associates are not directly subject to regulation by HHS
- Business associates are not covered entities, so not **REQUIRED**** **to:
- Have a privacy officer
- Produce notice of privacy practices
- Have written policies and procedures
- Obtain authorization or consents
- Have complaint system
- Institute “firewalls” between covered and non-covered functions (as will be done by hybrid entities and HR departments)
- Instead, requirements and specific obligations are set by covered entity based on regulations and their own discretion
- Will vary according to covered entity/client, depending on functions performed by the business associate, risks, degree of oversight desired, and contractual protections desired

## Liability Standards and Implications

- CE only held responsible by HHS for conduct of BA if:
- the CE knew of a pattern of behavior by the BA that constitutes a material breach of the BA agreement; and
- the covered entity failed to take certain steps (described later)
- However, a CE may only disclose PHI to a BA if it first obtains satisfactory assurance that the BA will appropriately safeguard the PHI
- Implications:
- The CE _is_ responsible for getting the BA’s assurances (which are recorded in the BA agreement) but _not_ for conducting oversight of the BA
- So, many CEs will legitimately choose not to oversee their low-risk BAs
- But a “one-size-fits-all” approach to oversight of BAs ignores differences in risk (e.g., third party data warehouse versus shredding company)
- CEs may choose to oversee high risk BAs to minimize general legal liability or meet requirements of public programs
- In addition to active oversight, CEs should consider contractual protections such as indemnifications and insurance

## Business Associate Agreements 

- Covered entity obtains “assurances” and documents them in a business associate agreement
- Business associate agreement must contain at least certain provisions that address specific issues [164.504(e)]:
- Permitted uses and disclosures of PHI
- Appropriate safeguards of records
- Report any unauthorized disclosures to entity
- Subcontractors must agree to same conditions and restrictions
- Make PHI available for inspection, amendment, accounting
- Make books and records available for inspection by DHHS
- Destroy/return PHI at termination of contract
- Material breach by associate is grounds for termination
- May need additional provisions if PHI exchanges are electronic or standard transactions (see Security and Transaction regulations)

## BA Agreement Provisions

- 1. Permitted/required uses and disclosures of PHI
- BA agreement should provide a moderate level of detail
- Specific permitted uses, for example:
- Maintenance of databases or programs
- Actuarial analysis
- Determination of medical necessity
- Preparation and mailing of newsletters
- Permitted disclosures, for example to:
- Other entities, e.g. subcontractors, subsidiaries or parents
- Specific classes of recipients
- BA may use PHI for its own administration or disclose when required by law
- BA must maintain CE’s PHI separate from PHI of other CEs (exception: data aggregation)

## BA Agreement Provisions

- 2. Appropriate safeguards
- To prevent use or disclosure of the PHI other than as provided for in the agreement
- Extent and nature of safeguards determined by covered entity, depending on type of  business associate and services performed
- Might address through general certification; or
- If a covered entity, provide for same level of care and protection as covered entity’s own PHI; or
- Could include a range of typical HIPAA requirements, for example:
- Confidentiality training of BA staff handling covered entity PHI
- Written policies and procedures to show compliance with contractual obligations
- Physical security – storage, transfer, return, destruction
- System security for PHI in electronic form – system access, firewalls, encryption

## BA Agreement Provisions

- 3. Report any unauthorized disclosures
- Must be reported to the covered entity originally providing the PHI
- Relates to disclosures not specifically permitted by business associate agreement
- Whether disclosure made by BA or a subcontractor
- 4. Subcontractors must agree to the same conditions and restrictions
- Applies to subcontractors, agents to whom the business associate discloses  PHI as permitted by the BA agreement
- Applies to PHI received or created in connection with the covered entity
- Subcontractors must agree to the same restrictions and conditions that apply to the business associate
- Subcontractor BA agreements should be based on primary BA agreement

## BA Agreement Provisions

- 5. Make PHI available for inspection, amendment, accounting
- Cooperate in access (164.524) and amendment (164.526) processes for PHI maintained by BA that covered entity does not possess
- Supplement covered entity’s accounting of disclosures (164.528) made pursuant to authorizations (164.508) or
- In cases where authorization or consent not required (164.512)
- 6. Make books and records available for inspection
- By DHHS/OCR or designees; other federal agencies
- To determine covered entity’s compliance with regulations

## BA Agreement Provisions

- 7. Destroy/return PHI at termination of contract
- Destroy PHI received from or created for covered entity during contract; or
- Return such PHI to covered entity
- May not be feasible if business associate is subject to future audits, legal requirements for retention
- If not feasible, business associate must continue to safeguard PHI for as long as it retains the PHI
- 8. Material breach by business associate is grounds for termination
- Covered entity must intervene to cure breach
- If breach cannot be cured, must act to terminate contract
- If termination not feasible (e.g., sole provider, legal requirement to contract), must report to DHHS/OCR
- Covered entity may be liable for acts of business associate if it knew of pattern of violations and failed to take action

## Concluding Thoughts

- Covered entity gap analysis not appropriate for business associates – they are not covered entities
- Adoption of good practices can provide assurances to covered entity clients, increase competitive position
- Business associates should have input into terms of business associate agreement to ensure viability
- Some BAs want to dictate terms of business associate agreement, but may be unrealistic for large covered entities since they:
- bear legal and compliance burden
- can take business to competitors
- Possible BA certification assessments in future, but what are standards?

## Questions and Answers

- For more information:
- _http://aspe.hhs.gov/admnsimp/index.shtml_