Phil,
Sometimes
a provider may function EITHER as CE or a workforce member of a CE (as when a
physician is engaged in a “treatment” process in a hospital) and
sometimes that same provider may function as a BA or a workforce member of a CE
(as when that same physician provides a “peer review”
activity.) You see, in the Preamble to the (initial) Final Privacy rules,
HHS notes that, "independent contractors may or may not be workforce
members. However, for compliance purposes we will assume that such personnel
are members of the workforce if no business associate contract exists."
I hope that this helps.
Your questions are always welcome.
Matt
Matthew
Rosenblum
Chief Operations Officer
Privacy, Quality Management &
Regulatory Affairs
http://www.CPIdirections.com
CPI Directions, Inc.
10 West 15th Street, Suite 1922
New York, NY 10011
(212) 675-6367
[EMAIL PROTECTED]
CONFIDENTIALITY
NOTICE: This E-Mail is intended only for the use of the individual or entity to
which it is addressed and may contain information that is privileged,
confidential and exempt from disclosure under applicable law. If you have
received this communication in error, please do not distribute it. Please
notify the sender by E-Mail at the address shown and delete the original
message. Thank you.
AVISO DEL
CONFIDENCIALIDAD: Este email es solamente para el uso del individuo o la
entidad a la cual se dirige y puede contener información privilegiada,
confidencial y exenta de acceso bajo la ley aplicable. Si usted ha recibido
esta comunicación por error, por favor no lo distribuya. Favor notificar
al remitente del E-Mail a la dirección mostrada y elimine el mensaje original.
Gracias.
-----Original
Message-----
From: Matthew Rosenblum
[mailto:[EMAIL PROTECTED]]
Sent: Thursday, January 09, 2003
1:51 AM
To: WEDI SNIP Privacy Workgroup
List
Subject: RE: More questions on
Business Associate
Andy,
In most instances, when
PHI is shared between CEs, no BA relationship exists, and no BA contract would
be required. For example, when a CE (provider) discloses PHI to another
provider for the purpose of treating a patient, no BA relationship exists, and
consequently, no BA contract would be needed. Further, when a CE
(provider) discloses PHI to a health plan for the purpose of payment activities,
no BA relationship exists, and consequently no BA contract is required.
Generally, BA contracts
are only required by HIPAA when a CE discloses PHI for the purpose of a 2nd
entity using the PHI on behalf of the CE to help the CE perform a payment
activity or health care operation (i.e., non-treatment activities that include
a litany of HIPAA specified functions such as accounting, legal, consulting,
etc.) For example, if a hospital discloses PHI to an IT vendor, a BA
contract would probably be required. Also, if a hospital discloses PHI to
a physician for the purpose of performing “peer review” a BA
relations DOES exist, and a BA contact might be required. (Note that
“peer review” is a “health care operation” and NOT a
“treatment” activity.)
It is also worth noting
that even though a BA relationship may exist between a CE and a vendor,
sometimes HIPAA does NOT require a formal BA contract. As in the case of
consultants who do most of their work on-site (within the CE’s physical space)
and are working under the control or supervision of the CE.
I hope that this helps.
Your questions are always
welcome.
Matt
Matthew Rosenblum
Chief Operations Officer
Privacy, Quality
Management & Regulatory Affairs
http://www.CPIdirections.com
CPI Directions, Inc.
10 West 15th Street,
Suite 1922
New York, NY 10011
(212) 675-6367
[EMAIL PROTECTED]
CONFIDENTIALITY NOTICE: This E-Mail is intended only for the
use of the individual or entity to which it is addressed and may contain
information that is privileged, confidential and exempt from disclosure under
applicable law. If you have received this communication in error, please do not
distribute it. Please notify the sender by E-Mail at the address shown
and delete the original message. Thank you.
AVISO DEL CONFIDENCIALIDAD: Este email es solamente para el
uso del individuo o la entidad a la cual se dirige y puede contener información
privilegiada, confidencial y exenta de acceso bajo la ley aplicable. Si usted
ha recibido esta comunicación por error, por favor no lo distribuya.
Favor notificar al remitente del E-Mail a la dirección mostrada y elimine el
mensaje original. Gracias.
-----Original Message-----
From: Andy Watts
[mailto:[EMAIL PROTECTED]]
Sent: Wednesday, January 08, 2003
7:25 PM
To: WEDI SNIP Privacy Workgroup
List
Subject: More questions on
Business Associate
I am new to the group so I am not sure if some of
these issues have been discussed before. I have seen some e-mails on the issue
of Business Associates. We are also facing some situations and would appreciate
if someone can help clarify the doubts:
1. From time to time we refer some of our patients to
companies that lease Home care equipment. Would such companies be our Business
Associates?
2. We refer patients to Home health agencies. Would
they be BA?
3. We use contract Physical therapists to provide
different types of therapies to our patients. Would they be our BA as they come
into contact with PHI.
4. Some social workers provide services to our
patients. Since these are not necessarily for treatment purposes, would they be
our BA?
5. Finally, we use medical technologists from another
company from time to time to operate some of our medical equipment such as
X-Rays. Would that company or the medical technologists be our BA?
Regards,
Andy
Do you Yahoo!?
Yahoo!
Mail Plus - Powerful. Affordable. Sign up now
--- The WEDI SNIP listserv to which you are subscribed is not moderated. The
discussions on this listserv therefore represent the views of the individual
participants, and do not necessarily represent the views of the WEDI Board of
Directors nor WEDI SNIP. If you wish to receive an official opinion, post your
question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.
These listservs should not be used for commercial marketing purposes or
discussion of specific vendor products and services. They also are not intended
to be used as a forum for personal disagreements or unprofessional
communication at any time. You are currently subscribed to wedi-privacy as:
[EMAIL PROTECTED] To unsubscribe from this list, go to the
Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to
[EMAIL PROTECTED] If you need to unsubscribe but your
current email address is not the same as the address subscribed to the list,
please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org
---
The WEDI SNIP listserv to which you are subscribed is not moderated. The
discussions on this listserv therefore represent the views of the individual
participants, and do not necessarily represent the views of the WEDI Board of
Directors nor WEDI SNIP. If you wish to receive an official opinion, post your
question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/.
These listservs should not be used for commercial marketing purposes or
discussion of specific vendor products and services. They also are not intended
to be used as a forum for personal disagreements or unprofessional
communication at any time.
You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED]
To unsubscribe from this list, go to the Subscribe/Unsubscribe form at
http://subscribe.wedi.org or send a blank email to
[EMAIL PROTECTED]
If you need to unsubscribe but your current email address is not the same as
the address subscribed to the list, please use the Subscribe/Unsubscribe form
at http://subscribe.wedi.org
