I think these clearly fall under operations under (6) Business management and general administrative activities of the entity. Health care operations is meant to encompass the normal things a business does to "operate" or a run a business, which would include the mundane trash/secure disposal, janitors, transcription and other secretarial services, etc. The need for business associate agreement is dependent on whether access to PHI is necessary to accomplish the service.
Regards, lhc Leah Hole-Curry, JD FOX Systems, Inc. 602.708.1045 Information transmitted is confidential and may be proprietary to FOX Systems, Inc. It is intended only for the person or entity to which it is addressed. Anyone else is prohibited from disclosing, copying, or disseminating the contents or attachments. If you receive this in error, please notify sender immediately, or us at www.foxsys.com and delete from your system. >>> Jason Brege <[EMAIL PROTECTED]> 03/11/03 09:00 AM >>> I would have originally thought disposal was operations as well, but when I looked at the definition of healthcare operations in 164.501, it really seemed like a stretch. It doesn't fit into any of the 6 main areas under this definition: 1.Quality assessment and improvement activities, 2.Reviewing the competence or qualifications of health care professionals, 3.Underwriting, 4.Medical review/fraud and abuse, 5.Business planning and development, 6.Business management. The only place to squeeze it in would be Business Management, but shredding documents doesn't seem to really fit with the 5 "included but not limited to" examples under that part. It really just depends on your legal counsel and how your risk assessments see this issue. Practically, I think it would be absolutely insane to account for every piece of PHI on every piece of paper that you destroy. I think there are ways to justify this as Business Management, and I think your documentation of this decision would be key. I believe this is one reason why most entities have just brought shredders or shredding companies onsite. Thanks, Jason Brege Clinton A. Harkins, P.C. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Tuesday, March 11, 2003 11:18 AM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: RE: Tracking Disclosures by Business Associates Wouldn't disposal come under operations? We have a vendor who picks us locked bins of documents to be shredded. We have had them sign a Business Associate Agreement (we are also Business Associates.) I would not think there would be a need for accounting for these pick ups to be logged as disclosures. Joanne Marquez Senior Director Beech Street Corporation Account Services (949) 672-1519 -----Original Message----- From: Jason Brege [mailto:[EMAIL PROTECTED] Sent: Tuesday, March 11, 2003 7:32 AM To: WEDI SNIP Privacy Workgroup List Subject: RE: Tracking Disclosures by Business Associates I'm not entirely sure who "you" is in your question, but I assumed that you are asking about business associates disclosing to business associates, so here's a stab at an answer. It might also apply if you're asking about CE disclosures to transcription/disposal agencies. I believe a business associate would have to account for those disclosures to other business associates where the disclosure is not for treatment, payment, or healthcare operations purposes. Given our nature as a collection agency, most (if not all) of our disclosures are exempt from accounting because they are for payment purposes. If we had a transcription service, it could possibly need accounting, but I think that could be absorbed under payment purposes. It would depend on what type of service they are providing. The disposal agency is not TPO as far as I can determine, but if you're having them shred the information onsite, trained as a member of your workforce, it becomes a use rather than a disclosure. The only information taken offsite is shredded paper which formerly contained PHI. Thus nothing would be accounted for in the case of the disposal agency working onsite. Offsite, I think it would need further investigation. If we were a BA that had the practice of disclosing information to public health authorities or other organizations, then we would definitely have to account for those. I think the best assessment is to determine whether the BA is disclosing for TPO purposes or otherwise, and then direct them to account for the non-TPO disclosures that would be accounted for if done directly by the Covered Entity. Thanks, Jason Brege Clinton A. Harkins, P.C. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Tuesday, March 11, 2003 9:44 AM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: Re: Tracking Disclosures by Business Associates By the same token, for the patient accounting, would you have to include disclosures you make to business associates like transcription agencies and disposal agencies? They would come up very often... Jill Rubin, Esq. (617)388-2404 [EMAIL PROTECTED] --- This message is intended only for the use of the individual to which it is addressed and contains information that is privileged, confidential and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient or the employee or agent responsible for delivering the message to intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone and permanently delete the message immediately. Thank You --- The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/. These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services. They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time. You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED] To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED] If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org --- The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/. These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services. They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time. You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED] To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED] If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org
