Most HIPAA dialogue has focused on the big players: large healthcare systems, hospitals, and national health plans. But the class of businesses that have working relationships with those big players may be considered "covered entities" and thus subject
Most HIPAA dialogue has focused on the big players: large healthcare systems, hospitals, and national health plans. But the class of businesses that have working relationships with those big players may be considered "covered entities" and thus subject to the law as well.
"The effects of HIPAA on business associates of covered entities - equipment vendors, consultants, accountants, law firms - have not been fully explored in the media," said Tracy Field, an attorney with Arnall Golden Gregory in Atlanta.
The privacy rule also applies to enterprises that use or disclose protected health information in order to perform a function or activity on behalf of a covered entity. Covered entities must therefore enter into written contracts that bind their business associates to several obligations under the privacy rule.
Clearly, firms assisting in radiographic imaging and storing the data on the tapes are considered to be business associates. Several nuances in the regulations determine whether an agreement is needed, however, said Kristen Hughes, general counsel and director of HIPAA services for SG&A Consulting.
If the relationship does not involve the use or disclosure of protected information, for example, an agreement may not be needed at all. Conversely, companies performing services on behalf of a covered entity that involve or may involve the use or disclosure of such information will likely be asked to execute a business associate agreement, Hughes said.
"Business associates should be careful about contracts they are asked to sign because there were some HIPAA modifications made in August. Some versions still floating on the Web have not been updated," Field said.
It is important to understand that HIPAA does not directly regulate third parties, according to Hughes. Only covered entities are required to adhere to HIPAA's standards. It is the covered entity that will be held accountable under HIPAA and must answer for noncompliance. Therefore, business associates need to be aware that agreements will likely be written from the provider's perspective.
In particular, many providers seek indemnification in the event of a privacy breach.
"Before signing all those contracts, be sure you have insurance coverage," Field said. "There are some business associate contracts in which the hospital may want access to all your record keeping. You may not want them to have that access, and it's not required under the business associate agreements."
MRI-Based AI Radiomics Model Offers 'Robust' Prediction of Perineural Invasion in Prostate Cancer
July 26th 2024A model that combines MRI-based deep learning radiomics and clinical factors demonstrated an 84.8 percent ROC AUC and a 92.6 percent precision-recall AUC for predicting perineural invasion in prostate cancer cases.
Breast MRI Study Examines Common Factors with False Negatives and False Positives
July 24th 2024The absence of ipsilateral breast hypervascularity is three times more likely to be associated with false-negative findings on breast MRI and non-mass enhancement lesions have a 4.5-fold likelihood of being linked to false-positive results, according to new research.
Can Polyenergetic Reconstruction Help Resolve Streak Artifacts in Photon Counting CT?
July 22nd 2024New research looking at photon-counting computed tomography (PCCT) demonstrated significantly reduced variation and tracheal air density attenuation with polyenergetic reconstruction in contrast to monoenergetic reconstruction on chest CT.