What Is a Business Associate?
Last week I received the following question from Christina:
What makes a Business Associate qualify for Business Associate Agreement (BAA)?
These days most health care providers and health plans do not carry out all of their health care activities and functions by themselves. Instead, they often use the services of a variety of other individuals or businesses. Health & Human Services (HHS) defines this type of service provider as a Business Associates (BA), as defined in 45 CFR 160.103. A BA is a person or entity contracted to perform certain functions or activities that involve the use or disclosure of Protected Health Information (PHI) to provide services for a Covered Entity (CE).
CE’s are required to identify who their BA’s are and confirm there is a current Business Associate Agreement (BAA) in place. The BAA must limit the BA’s access to PHI to allow only what is necessary to carry out its activities for the CE.
BA functions and activities may include:
Claims processing or administration; Data analysis, processing or administration; Utilization review; Quality assurance; Billing; Benefit management; Practice management; and re-pricing.
The type of BA services may include:
Legal; Actuarial; Accounting; Consulting; Data Aggregation; Management; Administrative; Accreditation; and Financial.
Examples of Business Associates
- A third party administrator that assists a health plan with claims processing.
- A CPA firm whose accounting services to a health care provider involves access to PHI.
- An attorney whose legal services to a health plan involve access to PHI.
- A consultant that performs utilization reviews for a hospital.
- A health care clearinghouse that translates a claim from a non-standard format into a standard transaction on behalf of a health care provider and forwards the processed transaction to a payer.
- An independent medical transcriptionist that provides transcription services to a physician.
- A pharmacy benefits manager that manages a health plan’s pharmacist network.