Opinion ID: 3066860
Heading Depth: 3
Heading Rank: 1

Heading: “Business Associate”

Text: Under HIPAA, a “business associate” relates to and is defined in reference to a “covered entity.” The Privacy Rule’s construct of a “covered entity” extends to: (1) a health plan, (2) a health care clearinghouse, or (3) a health care provider who transmits any health information in electronic form in connection with a covered transaction. See 45 C.F.R. § 160.103 (2014). As the circuit court correctly ruled in its August 27th order, both Bateman and Sharpe qualify as covered entities under HIPAA. With scant analysis,25 the trial court and Legal Aid simply adopted the position that the patient advocates necessarily meet the HIPAA definition of a “business associate.” An examination of the pertinent regulations addressing the nature of a “business associate” clearly refutes this conclusion. Legal Aid repeatedly refers to itself as a “business associate” of the DHHR. Because the DHHR is not a “covered entity” under HIPAA, the relationship between Legal Aid and the DHHR is not controlling. To come within HIPAA’s exclusionary language, Legal Aid must be a “business associate” of Sharpe and Bateman. In further explanation of what is necessary to qualify as a “business associate,” the regulations provide that it is a 25 The trial court ruled that Legal Aid is a “business associate” as set forth in its contract with the DHHR and also due to its receipt of protected health information for quality assurance, patient safety, and other health care operations. As discussed infra, the DHHR’S description of Legal Aid as a “business associate” is neither controlling nor accurate. The review of protected health information as part of the provision of advocacy services at Sharpe and Bateman does not impel the conclusion that Legal Aid is a “business associate.” 14 person who: (i) On behalf of such covered entity . . . but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities listed at 42 CFR 320, billing, benefit management, practice management, and repricing; or (ii) Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation . . . , management, administrative, accreditation, or financial services to or for such covered entity . . . . 45 C.F.R. § 160.103. The DHHR argues, and we agree, that the patient advocacy services performed at Bateman and Sharpe are not performed on behalf of either of those facilities within the meaning of the Privacy Rule. See id. In purveying the list of activities that constitute services typically performed by a “business associate” for a “covered entity,” patient advocacy is noticeably absent. Rather than serving the interests of the hospitals in terms of providing managerial assistance with their operations, the patient advocates serve the personal interests of the patients who reside at those facilities. From the beginning, the provision of patient advocacy services was created to protect the interests of individual patients. See W.Va. Code § 27-5-9; 64 C.S.R. § 59-20.1 (mandating patient advocates in every behavioral health facility who are independent of facility management). Despite the 15 expanded role of the patient advocates with regard to systemic auditing, the primary objective in conducting these reviews is compliance with patient-oriented rights.26 While it might be tempting to view the provision of patient advocacy services as improving the operations of the facilities under discussion, the pivotal inquiry is whether the advocacy services are being offered by Legal Aid on behalf of the hospitals. That Legal Aid is not operating on behalf of Sharpe and Bateman is easily demonstrated by considering the adversity inherent to the role the patient advocates occupy in relation to those facilities. Rather than advancing the hospitals’ interests, the advocates are responsible for investigating individual grievances against the hospitals and identifying instances of the hospitals’ failure to comply with the civil rights afforded to institutionalized patients under state law. By design, the patient advocates operate independently of the hospitals’ interests and, most decidedly, not on their behalves. We further observe that the improper characterization of Legal Aid as “business associates” in the Grant Agreement does not serve to repair the underlying definitional disconnect.27 As the DHHR properly acknowledges, its identification of Legal Aid as a “business associate,” in an admitted and overly-expansive 26 The fact that the institutions may benefit from the provision of these auditing services does not alter the wholly independent and individual-oriented nature of the advocacy actions at issue. 27 The Grant Agreement makes clear that “Business Associate shall have the meaning given to such term in 45 CFR § 160.103.” 16 attempt to comply with HIPAA,28 has no corresponding ability to make the characterization a reality under the law. Based on the foregoing, we conclude that the trial court erred in finding that Legal Aid is a “business associate” of a “covered entity” under HIPAA.