- Authorizations (30)
                              - Business Associates (41)
                              - Compliance Dates (2)
                              - Covered Entities (14)
                              - Decedents (9)
                              - Disclosures for Law Enforcement Purposes (5)
                              - Disclosures for Rule Enforcement (1)
                              - Disclosures in Emergency Situations (2)
                              - Disclosures Required by Law (6)
                              - Disclosures to Family and Friends (28)
                              - Disposal of Protected Health Information (6)
                              - Facility Directories (7)
                              - Family Medical History Information (3)
                              - FERPA and HIPAA (10)
                              - Group Health Plans (3)
                              - Incidental Uses and Disclosures (10)
                              - Judicial and Administrative Proceedings (8)
                              - Minimum Necessary (14)
                              - Notice of Privacy Practice (20)
                              - Preemption of State Law (10)
                              - Privacy Rule: General Topics (12)
                              - Protected Health Information (2)
                              - Public Health Uses and Disclosures (13)
                              - Research Uses and Disclosures (20)
                              - Right to an Accounting of Disclosures (8)
                              - Right to File a Complaint (1)
                              - Right to Request a Restriction (4)
                              - Safeguards (13)
                              - Security Rule (24)
                              - Smaller Providers and Businesses (145)
                              - Student Immunizations (8)
                              - Transition Provisions (3)
                              - Treatment, Payment, and Health Care Operations Disclosures (30)
                              - Workers Compensation Disclosures (5)
                              - Limited Data Set (6)
                              - Marketing (17)
                              - Marketing - Refill Reminders (16)
                              - Personal Representatives and Minors (12)
                              - Right to Access and Research (58)
                              - Mental Health (35)
                              - Health Information Technology (41)
                              - Telehealth (11)

                      -   
                      -   
                      -   
                      -   
                      -   

# Does HIPAA require a covered entity or its EHR system developer to enter into a business associate agreement with an app designated by the individual in order to transmit ePHI to the app?   

It depends on the relationship between the app developer, and the covered entity and/or its EHR system developer.  A business associate is a person or entity who creates, receives, maintains or transmits PHI on behalf of (or for the benefit of) a covered entity (directly or through another business associate) to carry out covered functions of the covered entity.  An app’s facilitation of access to the individual’s ePHI at the individual’s request alone does not create a business associate relationship.  Such facilitation may include API terms of use agreed to by the third-party app (i.e., interoperability arrangements).

HIPAA does not require a covered entity or its business associate (e.g., EHR system developer) to enter into a business associate agreement with an app developer that does not create, receive, maintain, or transmit ePHI on behalf of or for the benefit of the covered entity (whether directly or through another business associate).  

However if the app was developed to create, receive, maintain, or transmit ePHI on behalf of the covered entity, or was provided by or on behalf of the covered entity (directly or through its EHR system developer, acting as the covered entity’s business associate), then a business associate agreement would be required.

More information about apps, business associates, and HIPAA is available at https://www.hhs.gov/hipaa/for-professionals/special-topics/developer-portal/index.html

 

Created 04/18/19

Content last reviewed September 2, 2020