As you re-evaluate your business associate agreements in advance of the September 23, 2013 implementation date of the HIPAA Omnibus rules, take a closer look and consider whether all of the organizations with whom your hospice has business associate agreements qualify as a business associate and require a business associate agreement. In working with hospices, we have found that many hospices have business associate agreements with nursing homes and others who do not meet the definition of a business associate. Consequently, many of the business associate agreements hospices have in place may not be needed. As further discussed below, hospices typically will only have a handful of contractors who require a business associate agreement.
There are two primary reasons a business partner will not be a business associate:
- The organization does not meet the definition of a business associate. The only people who are business associates are those who meet all of the following criteria:
- are an individual or entity;
- who performs a service on behalf of a hospice (i.e., covered entity); and
- that service involves creating, receiving, maintaining, or transmitting protected health information (PHI).
Many individuals and entities do not meet the definition of a business associate as they provide services directly to the patient, not "on behalf of" the hospice. For example, nursing homes, pharmacies, ambulances, and hospitals receive PHI for the purpose of providing services to patients, not to perform a service on behalf of the hospice, and therefore will not typically qualify as a business associate. In contrast, when a hospice shares PHI with a lawyer, clinical consultant, pharmacy benefit manager and others for the purpose of assisting the hospice with an administrative task a business associate agreement would generally be required because these organizations are providing a service for the hospice, not the patient.
- The organization meets the treatment exception to the definition of a business associate. Health care providers with whom hospices contract may also not require a business associate agreement because the relationship satisfies the treatment exception to the business associate definition. Under the treatment exception, health care providers who receive PHI from a hospice for purposes of providing direct treatment to patients are excepted from the definition of a business associate. In the new HIPAA Omnibus rules, the Department of Health and Human Services (DHHS) specifically moved the treatment exception to the "definition of 'business associate' itself as [an] exception[ ] to make clear that [DHHS] does not consider the recipients of the [PHI] in these circumstances to be business associates."