Are insurance companies considered business associates under HIPAA?
HIPAA Weekly Advisor, February 7, 2003
Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!
Q: Many of the insurance companies our hospital deals with contend they are not our business associates and, therefore, they are not required to sign our business associate agreement. Are insurance companies considered business associates under HIPAA?
A: They are correct; they are not usually business associates. Hospitals, other health care providers, and the insurance companies to which they submit claims are not business associates under typical circumstances.
At a simplified level, the core function of hospitals is to provide health care, and the core function of health insurance companies is to pay for it. While these covered entities need to interact and share PHI to accomplish these functions, they are not working for each other.
However, if one is performing additional services for or on behalf of the other, such as an insurance company that provides data aggregation services for the hospital, and that work requires access to or release of PHI, then the former becomes the latter's business associate. A business associate agreement will be necessary.
Editor's note: Answered by Kate Borten, CISSP, president of The Marblehead Group, in Marblehead, MA, and excerpted from the February 2003 issue of Briefings on HIPAA. This is not legal advice. Be sure to consult with your facility's legal counsel for legal matters.
Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!
Related Products
Most Popular
- Articles
-
- Q/A: Volume requirement for reporting hydration services
- Featured blog post: Nurses face felony charges after reporting physician to the Texas Medical Board
- Catch up on what's new with injections and infusions
- Topic: CMS, OESS post new security compliance review information, checklist
- HIPAA Q&A: Level of encryption needed for email
- Identify potential Medicaid RAC target areas
- Capturing all necessary codes for IUD insertion and removal can be challenging
- What does case-mix index mean to you?
- QA:Coding multiple initial infusions
- OB services: Coding inside and outside of the package
- E-mailed
-
- Q/A: Volume requirement for reporting hydration services
- Featured blog post: Nurses face felony charges after reporting physician to the Texas Medical Board
- HIPAA Q&A: Level of encryption needed for email
- Q&A: Follow CMS' coding guidelines when using modifier -25
- Catch up on what's new with injections and infusions
- CMS has reformulated payments for some bilateral procedures
- New conflicts of interest create new challenges
- Q/A. One injection code or two?
- What does case-mix index mean to you?
- ED-to-inpatient transfers are flawed with safety gaps
- Searched