45 CFR 164.502(e), 164.504(e), 164.532(d) and (e) (Obtain a duplicate in PDF)
New HHS Reality Sheet On Direct Legal responsibility of Enterprise Associates underneath HIPAA
Background
By legislation, the HIPAA Privateness Rule applies solely to coated entities – well being plans, well being care clearinghouses, and sure well being care suppliers. Nonetheless, most well being care suppliers and well being plans don’t perform all of their well being care actions and features by themselves. As an alternative, they usually use the companies of a wide range of different individuals or companies. The Privateness Rule permits coated suppliers and well being plans to reveal protected well being data to those “enterprise associates” if the suppliers or plans acquire passable assurances that the enterprise affiliate will use the data just for the needs for which it was engaged by the coated entity, will safeguard the data from misuse, and can assist the coated entity adjust to a few of the coated entity’s duties underneath the Privateness Rule. Lined entities might disclose protected well being data to an entity in its position as a enterprise affiliate solely to assist the coated entity perform its well being care features – not for the enterprise affiliate’s unbiased use or functions, besides as wanted for the correct administration and administration of the enterprise affiliate.
How the Rule Works
Basic Provision. The Privateness Rule requires {that a} coated entity acquire passable assurances from its enterprise affiliate that the enterprise affiliate will appropriately safeguard the protected well being data it receives or creates on behalf of the coated entity. The passable assurances have to be in writing, whether or not within the type of a contract or different settlement between the coated entity and the enterprise affiliate.
What Is a “Enterprise Affiliate?” A “enterprise affiliate” is an individual or entity that performs sure features or actions that contain the use or disclosure of protected well being data on behalf of, or supplies companies to, a coated entity. A member of the coated entity’s workforce is just not a enterprise affiliate. A coated well being care supplier, well being plan, or well being care clearinghouse generally is a enterprise affiliate of one other coated entity. The Privateness Rule lists a few of the features or actions, in addition to the actual companies, that make an individual or entity a enterprise affiliate, if the exercise or service entails the use or disclosure of protected well being data. The kinds of features or actions that will make an individual or entity a enterprise affiliate embody fee or well being care operations actions, in addition to different features or actions regulated by the Administrative Simplification Guidelines.
Enterprise affiliate features and actions embody: claims processing or administration; information evaluation, processing or administration; utilization evaluation; high quality assurance; billing; profit administration; follow administration; and repricing. Enterprise affiliate companies are: authorized; actuarial; accounting; consulting; information aggregation; administration; administrative; accreditation; and monetary. See the definition of “enterprise affiliate” at 45 CFR 160.103.
Examples of Enterprise Associates.
- A 3rd celebration administrator that assists a well being plan with claims processing.
- A CPA agency whose accounting companies to a well being care supplier contain entry to protected well being data.
- An lawyer whose authorized companies to a well being plan contain entry to protected well being data.
- A advisor that performs utilization evaluations for a hospital.
- A well being care clearinghouse that interprets a declare from a non-standard format into a regular transaction on behalf of a well being care supplier and forwards the processed transaction to a payer.
- An unbiased medical transcriptionist that gives transcription companies to a doctor.
- A pharmacy advantages supervisor that manages a well being plan’s pharmacist community.
Enterprise Affiliate Contracts. A coated entity’s contract or different written association with its enterprise affiliate should comprise the weather specified at 45 CFR 164.504(e). For instance, the contract should: Describe the permitted and required makes use of of protected well being data by the enterprise affiliate; Present that the enterprise affiliate won’t use or additional disclose the protected well being data apart from as permitted or required by the contract or as required by legislation; and Require the enterprise affiliate to make use of acceptable safeguards to forestall a use or disclosure of the protected well being data apart from as offered for by the contract. The place a coated entity is aware of of a fabric breach or violation by the enterprise affiliate of the contract or settlement, the coated entity is required to take cheap steps to treatment the breach or finish the violation, and if such steps are unsuccessful, to terminate the contract or association. If termination of the contract or settlement is just not possible, a coated entity is required to report the issue to the Division of Well being and Human Providers (HHS) Workplace for Civil Rights (OCR). Please view our Pattern Enterprise Affiliate Contract.
Transition Provisions for Current Contracts. Lined entities (apart from small well being plans) which have an current contract (or different written settlement) with a enterprise affiliate previous to October 15, 2002, are permitted to proceed to function underneath that contract for as much as one further yr past the April 14, 2003 compliance date, offered that the contract is just not renewed or modified previous to April 14, 2003. This transition interval applies solely to written contracts or different written preparations. Oral contracts or different preparations aren’t eligible for the transition interval. Lined entities with contracts that qualify are permitted to proceed to function underneath these contracts with their enterprise associates till April 14, 2004, or till the contract is renewed or modified, whichever is sooner, no matter whether or not the contract meets the Rule’s relevant contract necessities at 45 CFR 164.502(e) and 164.504(e). A coated entity should in any other case adjust to the Privateness Rule, comparable to making solely permissible disclosures to the enterprise affiliate and allowing people to train their rights underneath the Rule. See 45 CFR 164.532(d) and (e).
Exceptions to the Enterprise Affiliate Customary. The Privateness Rule contains the next exceptions to the enterprise affiliate normal. See 45 CFR 164.502(e). In these conditions, a coated entity is just not required to have a enterprise affiliate contract or different written settlement in place earlier than protected well being data could also be disclosed to the particular person or entity.
- Disclosures by a coated entity to a well being care supplier for therapy of the person. For instance:
- A hospital is just not required to have a enterprise affiliate contract with the specialist to whom it refers a affected person and transmits the affected person’s medical chart for therapy functions.
- A doctor is just not required to have a enterprise affiliate contract with a laboratory as a situation of revealing protected well being data for the therapy of a person.
- A hospital laboratory is just not required to have a enterprise affiliate contract to reveal protected well being data to a reference laboratory for therapy of the person.
- Disclosures to a well being plan sponsor, comparable to an employer, by a bunch well being plan, or by the medical health insurance issuer or HMO that gives the medical health insurance advantages or protection for the group well being plan, offered that the group well being plan’s paperwork have been amended to restrict the disclosures or one of many exceptions at 45 CFR 164.504(f) have been met.
- The gathering and sharing of protected well being data by a well being plan that could be a public advantages program, comparable to Medicare, and an company apart from the company administering the well being plan, such because the Social Safety Administration, that collects protected well being data to find out eligibility or enrollment, or determines eligibility or enrollment, for the federal government program, the place the joint actions are licensed by legislation.
Different Conditions in Which a Enterprise Affiliate Contract Is NOT Required.
- When a well being care supplier discloses protected well being data to a well being plan for fee functions, or when the well being care supplier merely accepts a reduced price to take part within the well being plan’s community. A supplier that submits a declare to a well being plan and a well being plan that assesses and pays the declare are every appearing by itself behalf as a coated entity, and never because the “enterprise affiliate” of the opposite.
- With individuals or organizations (e.g., janitorial service or electrician) whose features or companies don’t contain the use or disclosure of protected well being data, and the place any entry to protected well being data by such individuals can be incidental, if in any respect.
- With an individual or group that acts merely as a conduit for protected well being data, for instance, the US Postal Service, sure personal couriers, and their digital equivalents.
- Amongst coated entities who take part in an organized well being care association (OHCA) to make disclosures that relate to the joint well being care actions of the OHCA.
- The place a bunch well being plan purchases insurance coverage from a medical health insurance issuer or HMO. The connection between the group well being plan and the medical health insurance issuer or HMO is outlined by the Privateness Rule as an OHCA, with respect to the people they collectively serve or have served. Thus, these coated entities are permitted to share protected well being data that pertains to the joint well being care actions of the OHCA.
- The place one coated entity purchases a well being plan product or different insurance coverage, for instance, reinsurance, from an insurer. Every entity is appearing by itself behalf when the coated entity purchases the insurance coverage advantages, and when the coated entity submits a declare to the insurer and the insurer pays the declare.
- To reveal protected well being data to a researcher for analysis functions, both with affected person authorization, pursuant to a waiver underneath 45 CFR 164.512(i), or as a restricted information set pursuant to 45 CFR 164.514(e). As a result of the researcher is just not conducting a perform or exercise regulated by the Administrative Simplification Guidelines, comparable to fee or well being care operations, or offering one of many companies listed within the definition of “enterprise affiliate” at 45 CFR 160.103, the researcher is just not a enterprise affiliate of the coated entity, and no enterprise affiliate settlement is required.
- When a monetary establishment processes consumer-conducted monetary transactions by debit, credit score, or different fee card, clears checks, initiates or processes digital funds transfers, or conducts another exercise that immediately facilitates or results the switch of funds for fee for well being care or well being plan premiums. When it conducts these actions, the monetary establishment is offering its regular banking or different monetary transaction companies to its clients; it’s not performing a perform or exercise for, or on behalf of, the coated entity.
Please evaluation our Incessantly Requested Questions on Enterprise Associates in addition to different Incessantly Requested Questions in regards to the Privateness Rule.
Be taught extra about enterprise affiliate contracts
OCR HIPAA Privateness December 3, 2002 Revised April 3, 2003
Again to Prime