How to know if you’re a business associate

HIPAA defines business associates based on their relationship with covered entities. If you fit the HIPAA criteria and definition for business associates, you must comply with HIPAA regulations. 

What is a business associate?

Definition of a business associate

Under HIPAA, a business associate is an individual or entity that performs specific functions or provides services on behalf of a covered entity. Covered entities, including healthcare providers, health plans, and healthcare clearinghouses, often rely on business associates to carry out essential activities related to PHI.

Related: What is protected health information (PHI)?

Covered entities and their relationship with business associates

Covered entities are responsible for complying with HIPAA regulations to protect PHI. They may engage business associates to handle tasks involving PHI, such as billing, claims processing, IT services, legal advice, or data analysis. Business associates act as extensions of covered entities, facilitating their operations while ensuring the privacy and security of PHI.

Determining Your business associate status

Assessing Your relationship with covered entities

To determine if you qualify as a business associate, consider the nature of your relationship with covered entities. Ask yourself the following questions:

1. Do you provide services or perform functions for healthcare providers, health plans, or healthcare clearinghouses?
2. Are these services or functions integral to the covered entities' operations?
3. Do you have a contractual agreement or arrangement with covered entities to provide these services?

If you answered yes to these questions, you fall under the category of a business associate.

Analyzing your access to protected health information (PHI)

Another factor to consider is the extent to which you handle PHI. Ask yourself:

1. Do you have access to PHI as part of your role or the services you provide?
2. Do you handle, process, store, or transmit PHI on behalf of covered entities?
3. Is the information you handle directly related to patient healthcare and contains personal identifiers?

If your activities involve working with PHI on behalf of covered entities, you qualify as a business associate.

Related: HIPAA Compliant Email: The Definitive Guide

Reviewing the presence of a business associate agreement (BAA)

One key indicator of being a business associate is a written contract or agreement known as a business associate agreement (BAA). 

A BAA typically includes provisions such as:

1. The permitted uses and disclosures of PHI by the business associate
2. Safeguards to protect the PHI and ensure its confidentiality
3. Reporting requirements in the event of a breach or security incident
4. Indemnification and liability provisions
5. Terms regarding the termination of the agreement

The existence of a BAA signifies that you are recognized as a business associate by the covered entity. If you have a contractual relationship involving the exchange of PHI, ensure that a BAA is in place to formalize the arrangement.

Common types of business associates and their services

1. Third-party administrators (TPAs): TPAs are organizations that handle administrative tasks for health plans, including claims processing, enrollment, and premium collection. They have access to PHI to perform these services.
2. Billing companies: Billing companies specialize in processing and managing medical billing for healthcare providers. They handle patient information such as diagnoses, treatments, and insurance details, requiring them to comply with HIPAA regulations.
3. IT service providers: IT service providers offer technology-related services to covered entities, such as managing EHR systems, providing network infrastructure support, implementing cybersecurity measures, and ensuring compliance with HIPAA's Security rule. They may have access to PHI stored in digital systems and networks.
4. Lawyers, consultants, and accountants: Legal firms, consultants, and accounting professionals often work closely with covered entities on various matters, such as compliance with healthcare regulations, financial management, and strategic planning. While performing their services, they may have access to PHI or work with confidential patient data.
5. Health information exchanges (HIEs): HIEs facilitate the secure exchange of health information between different healthcare organizations, enabling better care coordination and information sharing. They handle PHI and ensure compliance with privacy and security requirements.
6. Document shredding or destruction companies: Proper disposal of PHI is essential to maintain privacy and security. Document shredding or destruction companies specialize in securely disposing of sensitive information, including medical records and patient data.

When you understand the definition of a business associate, assess your relationship with covered entities, and review your access to PHI, you can determine your obligations and responsibilities under HIPAA. 

Related: Business associate pays $2.3 million for HIPAA noncompliance