Medical Records and the Law

Business Associates 209agreement, that the business associate will appropriately safeguard theinformation. 498Persons who on behalf of a covered entity perform any of the followingfunctions that involve the use or disclosure of individually identifiablehealth information will be business associates. This is not anexclusive list, so performing other similar services for a covered entityin connection with an activity related to health care or health informationwould likely create a business associate relationship.• Claims processing or administration• Data analysis, processing, or administration• Utilization review• Quality assurance• Billing• Benefit management• Practice management• Repricing 499Thus, an independent medical transcriptionist that provides transcriptionservices to a physician, an independent billing company providingservices to a home health agency, and a third party administrator thatassists a health plan with claims processing are all business associates.One covered entity may be a business associate of another covered entity.For example, if one healthcare provider provides services, such ascompliance training for employees, to another healthcare provider, abusiness associate relationship will arise, and the two providers mustenter into a business associate agreement. If one covered entity is permittedunder the rules to disclose PHI to another covered entity, thatdisclosure may be made directly to a business associate who is acting onbehalf of the recipient covered entity. 500Persons who use or disclose PHI to perform any one of the followingcategories of services for covered entities are also considered businessassociates:• Legal• Actuarial49845 C.F.R. §§ 160.103 and 164.314(a).49945 C.F.R. § 160.103.500Department of Health and Human Services, Standards for Privacy, 47.