To: Our Valued
HOMELINK® Network dealers
Fr: Mary Nicholas, Privacy Officer
Dt: February 20, 2003
Re: Business Associate Agreements
We have received several requests to execute HIPAA Business Associate Agreements (ostensibly to comply with certain final HIPAA Privacy Rules) from various homecare dealers within the HOMELINK network.
The purpose of this summary is to provide you an explanation and analysis of why we believe a business associate relationship is unnecessary and inappropriate. Specifically, the following facts make up the basis of our determination:
· HOMELINK is a health care dealer and covered entity. The privacy rule includes health care dealers that transmit any health information in electronic form in connection with HIPAA-standard transactions within its definition of a covered entity. The definition of a health care dealer used by HHS includes a "dealer of services" or "dealer of medical or health services". It also encompasses any other person or organization that furnishes, bills, or is paid for health care services or supplies in the normal course of business.
· HOMELINK provides treatment to patients. In addition to effecting managed care referrals (e.g., delivery of medical equipment, supplies, nursing services, etc.) to its network of dealers, HOMELINK provides direct treatment to patients. "Treatment" may include our direct shipment of medical equipment and supplies to patients, consultation and follow-up with the patient (regardless of which entity provided the actual medical equipment or service), and other various "patient services", as defined by HHS (*).
· HOMELINK may disclose PHI for the treatment activities of another health care dealer. The Privacy Rule permits a covered entity to use and disclose protected health information for treatment, payment, or health care operations. Uses and disclosures for treatment are broad because the definition of treatment incorporates the interaction among more than one entity; specifically, coordination and management of health care among health care dealers or by a health care dealer with a third party, consultations between health care dealers, and referrals of a patient for health care from one health care dealer to another. As a result, covered entities are permitted to disclose protected health information for treatment regardless of to whom the disclosure is made, as well as to disclose protected health information for the treatment activities of another health care dealer.
· HOMELINK is not
required to enter into business associate agreements (contracts) with health
care dealers. The Notice of Proposed Rulemaking issued on March 27, 2002,
clarified HHS's position that health care dealers are not required to have
business associate contracts in order to share protected health information
for treatment purposes. Furthermore, according to HHS, discount payment arrangements
between a health care dealer and a health plan do not require business associate
relationships, per 67 Fed. Reg. 14788 (+).
Should you or your legal counsel have questions or concerns regarding this determination, please feel free to contact me at 800-482-1993. In all cases, please be assured HOMELINK respects and complies with all legislation to protect patient confidentiality.
Thank you.
------------------------------------------------------------------------------------------------------------
(*) HHS has determined that many of these services, such as home medical equipment instruction or nursing assistance provided through a telephone service are considered treatment activities if performed by or on behalf of a health care dealer.
(+) On a related matter,
certain dealers within the HOMELINK managed care network suggested that HOMELINK
might be considered a "health plan" (ostensibly as HOMELINK is the
"payer" and the dealer submits its claim for reimbursement directly
to HOMELINK). Generally, dealers are not business associates of payers/health
plans. When a health care dealer discloses PHI to health plans for payment
purposes only, no business associate relationship is established. While the
covered dealer may have an agreement to accept discounted fees as reimbursement
for services provided to health plan members, neither entity is acting on behalf
of or providing a service to the other, so no business associate relationship
is established. See the discussions at 67 Fed. Reg. 14776,14788 (March 27, 2002)
concerning this issue.
------------------------------------------------------------------------------------------------------------
Organizational Requirements: Business Associates
Citations
The following sections of the Final Privacy Rule as Modified and the Privacy Rule preambles address requirements related to business associates. The term "business associate" is defined and the circumstances under which protected health information may be disclosed to or used by a business associate are prescribed in the following sections of 45 CFR Parts 160 and 164:
o §160.103 - Definitions
- Business Associates, Workforce
o §164.502(e) - Uses and disclosures of protected health information: General
rules - Standard: Disclosures to business associates
o §164.504(e) - Uses and disclosures: Organizational requirements -- Standard:
Business associate contracts
o §164.532(e) - Transition Provisions - Effect of prior contracts or other
arrangements with business associates
o Preamble to the Final Rule, pg. 82,475-76 - HHS Commentary on Definition of
Business Associate
o Preamble to the Final Rule, pg. 82,480 - HHS Commentary on Definition of Workforce
o Preamble to the Final Rule, pg. 82,499 & 82,503-07 - HHS discussion of
business associate standard
o Preamble to the Final Rule, pg. 82,640-48 - HHS discussion of public comments
on proposed rule related to business associates
o Preamble to the Final Rule, pg. 82,579 - HHS discussion of public comments
on proposed rule relating to workforce
o First Guidance on the Privacy Rule 07/06/01 - Business Associates
o Preamble to the Modifications, pg. 53,248-54 - HHS discussion of business
associate provisions and transition rule
o Appendix to the Preamble to the Modifications, pg. 53,262-66 - Sample Business
Associate Contract Provisions