• E-mail
• Print
• RSS

Is a business associate agreement always required when disclosing patient information for healthcare operations?

HIPAA Weekly Advisor, January 17, 2005

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

Although generally disclosures for healthcare operations will involve a business associate relationship with the recipient of the information, there are certain situations in which a business associate agreement would not be applicable. The test is whether the entity receiving the information is providing a service for the covered entity.

In this context, HHS notes in the commentary to the regulations: "Whether a disclosure is allowable for health care operations is determined separately from whether a business associate contract is required. These provisions of the rule operate independently. Disclosures for health care operations may be made to an entity that is neither a covered entity nor a business associate of the covered entity. For example, a covered academic medical center may disclose certain protected health information to community health care providers who participate in one of its continuing medical education programs, whether or not such providers are covered health care providers. A provider attending a continuing education program is not thereby performing services for the covered entity sponsoring the program and, thus, is not a business associate for that purpose."

Editor's note: Attorneys from Bricker and Eckler LLP answered this question. For more information, see Section 164.501 Definitions: Health Care Operations.

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

• E-mail to a Colleague
• Print
• RSS
• Archive