Book:HIPAA Compliance: An Introduction/Who needs to comply?

Who needs to comply?

HIPAA compliance is highly important in the healthcare arena. Non-compliance can result in fines and other serious consequences. But who is actually bound by this law? HIPAA is comprised of two main segments: the Privacy Rule and the Security Rule. Those who must comply are called "covered entities." According to the HHS, these include:

▪ health plans;

▪ healthcare clearinghouses; and

▪ any healthcare provider who transmits health information in electronic form in connection with a transaction for which the Secretary of HHS has adopted standards under HIPAA.

Covered entities include doctors, clinics, hospitals, dentists, nursing homes and pharmacies that transmit data electronically, as well as health plans, insurance plans and healthcare clearinghouses.^[1]

Healthcare providers

Every healthcare provider (regardless of size) who electronically transmits health information in connection with certain transactions is a covered entity. These transactions include^[1]:

claims
benefit eligibility inquiries
referral authorization requests
other transactions for which HHS has established standards under the HIPAA Transactions Rule

It's important to note that using electronic technology (e.g., email) does not mean a healthcare provider is a covered entity. The transmission must be in connection with a "standard transaction."

Transactions are electronic exchanges involving the transfer of information between two parties for specific purposes. For example, a healthcare provider will send a claim to a health plan to request payment for medical services.^[2]

In the HIPAA regulations, the Secretary of Health and Human Services adopted certain standard transactions for electronic data interchange (EDI) of healthcare data. These transactions include^[2]:

claims and encounter information
payment and remittance advice
claims status
eligibility, enrollment and disenrollment
referrals and authorizations
coordination of benefits and premium payment

The standard does not encompass telephone voice response and fax-back systems.^[3]

The Privacy Rule covers a healthcare provider whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf. Healthcare providers include all “providers of services” (e.g., institutional providers such as hospitals) and “providers of medical or health services” (e.g., non-institutional providers such as physicians, dentists and other practitioners) as defined by Medicare, and any other person or organization that furnishes, bills, or is paid for healthcare.^[1]

Business associates

Healthcare providers don't always do everything that involves patient information themselves. There are very often other entities contracted for a variety of services. As a result of the Health Information Technology for Economic and Clinical Health Act (HITECH) that was passed in 2009, HIPAA has also been expanded to include business associates. Business associates are those persons or organizations that function on behalf of a covered entity, such as a doctor, and who either use or receive identifiable health information.^[4]

According to 45 CFR 160 Part 103, business associate functions or activities on behalf of a covered entity include^[5]:

claims processing
data analysis
utilization review
billing
legal services
actuarial services
accounting
consulting
data aggregation
management
administrative services
accreditation
financial services

A business associate is also anyone—not just those in the workforce of the covered entity—who performs any activities for a covered entity that are covered by HIPAA. Consider that an "...and all other related" kind of clause. Subcontractors of business associates who fit these criteria are also subject to HIPAA.^[5]

However, persons or organizations are not considered business associates if their functions or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all. A covered entity can also be the business associate of another covered entity.^[1]

Here are some examples of business associates, as described by the HHS^[6] :

third party administrator who assists a health plan with claims processing
CPA firm whose accounting services to a healthcare provider involve access to protected health information
attorney whose legal services to a health plan involve access to protected health information
consultant who performs utilization reviews for a hospital
healthcare clearinghouse that translates a claim from a non-standard format into a standard transaction on behalf of a healthcare provider and forwards the processed transaction to a payer
independent medical transcriptionist who provides transcription services to a physician
pharmacy benefits manager who manages a health plan’s pharmacist network

Business associate agreement (BAA)

According to the HHS, "A covered entity’s contract or other written arrangement with its business associate must contain the elements specified at 45 CFR 164.504(e)." Provisions need to^[6]:

describe the permitted and required uses of protected health information by the business associate;
provide that the business associate will not use or further disclose the protected health information (PHI) other than as permitted or required by the contract or as required by law; and
require the business associate to use appropriate safeguards to prevent a use or disclosure of the protected health information other than as provided for by the contract.

Where a covered entity (the party who has contracted the BA) knows of a material breach or violation by the business associate of the contract or agreement, the covered entity is required to take reasonable steps to cure the breach or end the violation, and if such steps are unsuccessful, to terminate the contract or arrangement. If termination of the contract or agreement is not feasible, a covered entity is required to report the problem to the OCR.

HHS provides a useful sample BAA on its website for reference.

Exceptions to BAA requirement

There are exceptions to the requirement for a covered entity to have a BAA with a business associate before protected health information may be disclosed to the person or entity. Per 45 CFR 164.502(e), the Privacy Rule includes the following exceptions to the business associate standard^[6]:

disclosures by a covered entity to a healthcare provider for treatment of the individual. For example:
1. A hospital is not required to have a business associate contract with the specialist to whom it refers a patient and transmits the patient’s medical chart for treatment purposes.
2. A physician is not required to have a business associate contract with a laboratory as a condition of disclosing protected health information for the treatment of an individual.
3. A hospital laboratory is not required to have a business associate contract to disclose protected health information to a reference laboratory for treatment of the individual.
disclosures to a health plan sponsor, such as an employer, by a group health plan, or by the health insurance issuer or health maintenance organization (HMO) that provides the health insurance benefits or coverage for the group health plan, provided that the group health plan’s documents have been amended to limit the disclosures or one of the exceptions at 45 CFR 164.504(f) have been met.
the collection and sharing of protected health information by a health plan that is a public benefits program, such as Medicare, and an agency other than the agency administering the health plan, such as the Social Security Administration, that collects protected health information to determine eligibility or enrollment, or determines eligibility or enrollment, for the government program, where the joint activities are authorized by law.

Other situations in which a business associate contract is NOT required

Some additional scenarios where a BAA is not necessary include^[6]:

when a healthcare provider discloses protected health information to a health plan for payment purposes, or when the healthcare provider simply accepts a discounted rate to participate in the health plan’s network. A provider that submits a claim to a health plan and a health plan that assesses and pays the claim are each acting on its own behalf as a covered entity, and not as the “business associate” of the other.
with persons or organizations (e.g., janitorial service or electrician) whose functions or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all.
where a person or organization acts merely as a conduit for protected health information, for example the U.S. Postal Service, certain private couriers and their electronic equivalents.
covered entities who participate in an organized healthcare arrangement (OHCA) to make disclosures that relate to the joint healthcare activities of the OHCA.
when a group health plan purchases insurance from a health insurance issuer or HMO. The relationship between the group health plan and the health insurance issuer or HMO is defined by the Privacy Rule as an OHCA, with respect to the individuals they jointly serve or have served. Thus, these covered entities are permitted to share protected health information that relates to the joint healthcare activities of the OHCA.
where one covered entity purchases a health plan product or other insurance, for example, reinsurance, from an insurer. Each entity is acting on its own behalf when the covered entity purchases the insurance benefits, and when the covered entity submits a claim to the insurer and the insurer pays the claim.
the disclosure of protected health information to a researcher for research purposes, either with patient authorization, pursuant to a waiver under 45 CFR 164.512(i), or as a limited data set pursuant to 45 CFR 164.514(e). Because the researcher is not conducting a function or activity regulated by the Administrative Simplification Rules, such as payment or healthcare operations, or providing one of the services listed in the definition of “business associate” at 45 CFR 160.103, the researcher is not a business associate of the covered entity, and no business associate agreement is required.
when a financial institution processes consumer-conducted financial transactions by debit, credit, or other payment card, clears checks, initiates or processes electronic funds transfers, or conducts any other activity that directly facilitates or effects the transfer of funds for payment for healthcare or health plan premiums. When it conducts these activities, the financial institution is providing its normal banking or other financial transaction services to its customers; it is not performing a function or activity for, or on behalf of, the covered entity.

Others (plans, etc.)

The other categories of "covered entities" who are subject to the requirements of HIPAA include health plans and healthcare clearinghouses.

Health plans

Whether individual or group, health plans that provide or pay the cost of healthcare, dental care, vision care, and prescription drug costs are covered entities under HIPAA. This includes HMOs; Medicare, Medicaid, Medicare+Choice and Medicare supplement insurers; and long-term care insurers (excluding nursing home fixed-indemnity policies).

Covered entity health plans can be employer-sponsored group health plans, government- and church-sponsored health plans or multi-employer health plans.^[1]

Health plan exceptions

The exceptions where certain health plans do not constitute covered entities include^[1]:

group health plans with less than 50 participants, administered solely by the employer that established and maintains the plan.
two types of government-funded programs:
1. those whose principal purpose is not providing or paying the cost of healthcare, such as the food stamps program (SNAP).
2. those programs whose principal activity is directly providing healthcare, such as a community health center, or the making of grants to fund the direct provision of healthcare.
certain types of insurance entities, particularly those who only provide:
1. workers’ compensation.
2. automobile insurance.
3. property and casualty insurance.

However, if an insurance entity has more than one line of business, one of which may be identified separately as a health plan, then HIPAA regulations do apply to the health plan line of business.

Healthcare clearinghouses

Health care clearinghouses are entities that process nonstandard information they receive from another entity into a standard (i.e., standard format or data content), or vice versa.

In most instances, healthcare clearinghouses will receive individually-identifiable health information only when they are providing these processing services to a health plan or healthcare provider as a Business Associate. In those cases, only certain provisions of the Privacy Rule are applicable to uses and disclosures of protected health information.^[1]

Healthcare clearinghouses include^[1]: