Difference between revisions of "LII:HIPAA Compliance - LII 007 02. Who Needs to Comply?"

From LIMSWiki
Jump to navigationJump to search
Line 67: Line 67:


====Business Associate Agreement (BAA)====
====Business Associate Agreement (BAA)====
A covered entity’s contract or other written arrangement with its business associate must contain the elements specified at 45 CFR 164.504(e). For example, the contract must: Describe the permitted and required uses of protected health information by the business associate; Provide that the business associate will not use or further disclose the protected health information other than as permitted or required by the contract or as required by law; and Require the business associate to use appropriate safeguards to prevent a use or disclosure of the protected health information other than as provided for by the contractWhere a covered entity knows of a material breach or violation by the business associate of the contract or agreement, the covered entity is required to take reasonable steps to cure the breach or end the violation, and if such steps are unsuccessful, to terminate the contract or arrangement. If termination of the contract or agreement is not feasible, a covered entity is required to report the problem to the Department of Health and Human Services (HHS) Office for Civil Rights (OCR).  Guidance on constructing a BAA is available from the HHS at http://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html.  
According to the [[HHS]], "A covered entity’s contract or other written arrangement with its business associate must contain the elements specified at 45 CFR 164.504(e)". Provisions need to include:  
 
* Describe the permitted and required uses of protected health information by the business associate
* Provide that the business associate will not use or further disclose the protected health information (PHI) other than as permitted or required by the contract or as required by law
* Require the business associate to use appropriate safeguards to prevent a use or disclosure of the protected health information other than as provided for by the contract
 
Where a covered entity (the party who has contracted the BA) knows of a material breach or violation by the business associate of the contract or agreement, the covered entity is required to take reasonable steps to cure the breach or end the violation, and if such steps are unsuccessful, to terminate the contract or arrangement. If termination of the contract or agreement is not feasible, a covered entity is required to report the problem to the Department of Health and Human Services (HHS) Office for Civil Rights (OCR).   
 
Guidance on constructing a BAA is available from the HHS at http://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html.
 
====Exceptions to BAA Requirement====
There are exceptions to the requirement for a covered entity to have a BAA with a business associate before protected health information may be disclosed to the person or entity. Per 45 CFR 164.502(e), the Privacy Rule includes the following exceptions to the business associate standard: 
 
# Disclosures by a covered entity to a health care provider for treatment of the individual. For example:
## A hospital is not required to have a business associate contract with the specialist to whom it refers a patient and transmits the patient’s medical chart for treatment purposes.
## A physician is not required to have a business associate contract with a laboratory as a condition of disclosing protected health information for the treatment of an individual.
## A hospital laboratory is not required to have a business associate contract to disclose protected health information to a reference laboratory for treatment of the individual. 
# Disclosures to a health plan sponsor, such as an employer, by a group health plan, or by the health insurance issuer or HMO that provides the health insurance benefits or coverage for the group health plan, provided that the group health plan’s documents have been amended to limit the disclosures or one of the exceptions at 45 CFR 164.504(f) have been met. 
# The collection and sharing of protected health information by a health plan that is a public benefits program, such as Medicare, and an agency other than the agency administering the health plan, such as the Social Security Administration, that collects protected health information to determine eligibility or enrollment, or determines eligibility or enrollment, for the government program, where the joint activities are authorized by law. 
Other Situations in Which a Business Associate Contract Is NOT Required.
 
When a health care provider discloses protected health information to a health plan for payment purposes, or when the health care provider simply accepts a discounted rate to participate in the health plan’s network. A provider that submits a claim to a health plan and a health plan that assesses and pays the claim are each acting on its own behalf as a covered entity, and not as the “business associate” of the other. 
With persons or organizations (e.g., janitorial service or electrician) whose functions or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all.
With a person or organization that acts merely as a conduit for protected health information, for example, the US Postal Service, certain private couriers, and their electronic equivalents.
Among covered entities who participate in an organized health care arrangement (OHCA) to make disclosures that relate to the joint health care activities of the OHCA.
Where a group health plan purchases insurance from a health insurance issuer or HMO. The relationship between the group health plan and the health insurance issuer or HMO is defined by the Privacy Rule as an OHCA, with respect to the individuals they jointly serve or have served. Thus, these covered entities are permitted to share protected health information that relates to the joint health care activities of the OHCA.
Where one covered entity purchases a health plan product or other insurance, for example, reinsurance, from an insurer. Each entity is acting on its own behalf when the covered entity purchases the insurance benefits, and when the covered entity submits a claim to the insurer and the insurer pays the claim.
To disclose protected health information to a researcher for research purposes, either with patient authorization, pursuant to a waiver under 45 CFR 164.512(i), or as a limited data set pursuant to 45 CFR 164.514(e). Because the researcher is not conducting a function or activity regulated by the Administrative Simplification Rules, such as payment or health care operations, or providing one of the services listed in the definition of “business associate” at 45 CFR 160.103, the researcher is not a business associate of the covered entity, and no business associate agreement is required.
When a financial institution processes consumer-conducted financial transactions by debit, credit, or other payment card, clears checks, initiates or processes electronic funds transfers, or conducts any other activity that directly facilitates or effects the transfer of funds for payment for health care or health plan premiums. When it conducts these activities, the financial institution is providing its normal banking or other financial transaction services to its customers; it is not performing a function or activity for, or on behalf of, the covered entity. 


===Others (Plans, etc.)===
===Others (Plans, etc.)===

Revision as of 16:28, 8 June 2016

HIPAA compliance is highly important in the healthcare arena. Non-compliance can result in fines and other serious consequences. But who is actually bound by this law? HIPAA is comprised of two main segments, the Privacy Rule and the Security Rule. Those who must comply are called "covered entities". According to the HHS, these are:

HIPAA Covered Entities:

HIPAA Course Insert 1.png

So covered entities are doctors, clinics, hospitals, dentists, nursing homes and pharmacies that transmit data electronically, as well as health plans, insurance plans and healthcare clearinghouses.[1]

Healthcare Providers

Every health care provider (regardless of size) who electronically transmits health information in connection with certain transactions, is a covered entity. These transactions include:

  • Claims
  • Benefit eligibility inquiries
  • Referral authorization requests
  • Other transactions for which HHS has established standards under the HIPAA Transactions Rule

It's important to note that using electronic technology (e.g. email) does not mean a healthcare provider is a covered entity. The transmission must be in connection with a "standard transaction".

Transactions are electronic exchanges involving the transfer of information between two parties for specific purposes. For example, a healthcare provider will send a claim to a health plan to request payment for medical services.[2]

In the HIPAA regulations, the Secretary of Health and Human Services (HHS) adopted certain standard transactions for Electronic Data Interchange (EDI) of healthcare data. These transactions are:

  • Claims and encounter information
  • Payment and remittance advice
  • Claims status
  • Eligibility, enrollment and disenrollment
  • Referrals and authorizations
  • Coordination of benefits and premium payment[2]

The standard does not encompass telephone voice response and fax-back systems.[3]

The Privacy Rule covers a healthcare provider whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf. Healthcare providers include all “providers of services” (e.g., institutional providers such as hospitals) and “providers of medical or health services” (e.g., non-institutional providers such as physicians, dentists and other practitioners) as defined by Medicare, and any other person or organization that furnishes, bills, or is paid for healthcare.[1]

Business Associates

Healthcare providers don't always do everything that involves patient information themselves. There are very often other entities contracted for a variety of services. As a result of the Health Information Technology for Economic and Clinical Health (HITECH) Act that was passed in 2009, HIPAA has also been expanded to include business associates. Business associates are those persons or organizations that function on behalf of a covered entity, such as a doctor, and who either use or receive identifiable health information.[4]

According to 45 CFR 160 part 103 Definitions, Business Associate functions or activities on behalf of a covered entity include:

  • Claims processing
  • Data analysis
  • Utilization review
  • Billing
  • Legal services
  • Actuarial services
  • Accounting
  • Consulting
  • Data aggregation
  • Management
  • Administrative services
  • Accreditation
  • Financial services

A Business Associate is also anyone, not in the workforce of the covered entity, who performs any activities for a covered entity that are covered by HIPAA. Consider that an "...and all other related" kind of clause. Subcontractors of Business Associates who fit these criteria are also subject to HIPAA.[5]

However, persons or organizations are not considered business associates if their functions or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all. A covered entity can also be the business associate of another covered entity.[1]

Here are some examples provided by the HHS of Business Associates:

  • A third party administrator that assists a health plan with claims processing.
  • A CPA firm whose accounting services to a health care provider involve access to protected health information.
  • An attorney whose legal services to a health plan involve access to protected health information.
  • A consultant who performs utilization reviews for a hospital.
  • A healthcare clearinghouse that translates a claim from a non-standard format into a standard transaction on behalf of a health care provider and forwards the processed transaction to a payer.
  • An independent medical transcriptionist who provides transcription services to a physician.
  • A pharmacy benefits manager who manages a health plan’s pharmacist network.[6]

Business Associate Agreement (BAA)

According to the HHS, "A covered entity’s contract or other written arrangement with its business associate must contain the elements specified at 45 CFR 164.504(e)". Provisions need to include:

  • Describe the permitted and required uses of protected health information by the business associate
  • Provide that the business associate will not use or further disclose the protected health information (PHI) other than as permitted or required by the contract or as required by law
  • Require the business associate to use appropriate safeguards to prevent a use or disclosure of the protected health information other than as provided for by the contract

Where a covered entity (the party who has contracted the BA) knows of a material breach or violation by the business associate of the contract or agreement, the covered entity is required to take reasonable steps to cure the breach or end the violation, and if such steps are unsuccessful, to terminate the contract or arrangement. If termination of the contract or agreement is not feasible, a covered entity is required to report the problem to the Department of Health and Human Services (HHS) Office for Civil Rights (OCR).

Guidance on constructing a BAA is available from the HHS at http://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html.

Exceptions to BAA Requirement

There are exceptions to the requirement for a covered entity to have a BAA with a business associate before protected health information may be disclosed to the person or entity. Per 45 CFR 164.502(e), the Privacy Rule includes the following exceptions to the business associate standard:

  1. Disclosures by a covered entity to a health care provider for treatment of the individual. For example:
    1. A hospital is not required to have a business associate contract with the specialist to whom it refers a patient and transmits the patient’s medical chart for treatment purposes.
    2. A physician is not required to have a business associate contract with a laboratory as a condition of disclosing protected health information for the treatment of an individual.
    3. A hospital laboratory is not required to have a business associate contract to disclose protected health information to a reference laboratory for treatment of the individual.
  2. Disclosures to a health plan sponsor, such as an employer, by a group health plan, or by the health insurance issuer or HMO that provides the health insurance benefits or coverage for the group health plan, provided that the group health plan’s documents have been amended to limit the disclosures or one of the exceptions at 45 CFR 164.504(f) have been met.
  3. The collection and sharing of protected health information by a health plan that is a public benefits program, such as Medicare, and an agency other than the agency administering the health plan, such as the Social Security Administration, that collects protected health information to determine eligibility or enrollment, or determines eligibility or enrollment, for the government program, where the joint activities are authorized by law.

Other Situations in Which a Business Associate Contract Is NOT Required.

When a health care provider discloses protected health information to a health plan for payment purposes, or when the health care provider simply accepts a discounted rate to participate in the health plan’s network. A provider that submits a claim to a health plan and a health plan that assesses and pays the claim are each acting on its own behalf as a covered entity, and not as the “business associate” of the other. With persons or organizations (e.g., janitorial service or electrician) whose functions or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all. With a person or organization that acts merely as a conduit for protected health information, for example, the US Postal Service, certain private couriers, and their electronic equivalents. Among covered entities who participate in an organized health care arrangement (OHCA) to make disclosures that relate to the joint health care activities of the OHCA. Where a group health plan purchases insurance from a health insurance issuer or HMO. The relationship between the group health plan and the health insurance issuer or HMO is defined by the Privacy Rule as an OHCA, with respect to the individuals they jointly serve or have served. Thus, these covered entities are permitted to share protected health information that relates to the joint health care activities of the OHCA. Where one covered entity purchases a health plan product or other insurance, for example, reinsurance, from an insurer. Each entity is acting on its own behalf when the covered entity purchases the insurance benefits, and when the covered entity submits a claim to the insurer and the insurer pays the claim. To disclose protected health information to a researcher for research purposes, either with patient authorization, pursuant to a waiver under 45 CFR 164.512(i), or as a limited data set pursuant to 45 CFR 164.514(e). Because the researcher is not conducting a function or activity regulated by the Administrative Simplification Rules, such as payment or health care operations, or providing one of the services listed in the definition of “business associate” at 45 CFR 160.103, the researcher is not a business associate of the covered entity, and no business associate agreement is required. When a financial institution processes consumer-conducted financial transactions by debit, credit, or other payment card, clears checks, initiates or processes electronic funds transfers, or conducts any other activity that directly facilitates or effects the transfer of funds for payment for health care or health plan premiums. When it conducts these activities, the financial institution is providing its normal banking or other financial transaction services to its customers; it is not performing a function or activity for, or on behalf of, the covered entity.

Others (Plans, etc.)

References