According to HIPAA, who are my Business Associates?

by  Brandy Brimhall, CPC, CMCO, CCCPC, CPCO, CPMA
September 11th, 2014

Providers work with many different groups and many of them have some interaction with Protected Health Information (PHI). In an effort to help us understand who qualifies as Business Associates the Department of Health & Human Services has provided some resources.  

But first … what is PHI or individually identifiable health information? Basically, it is any information used to identify an individual patient as well as information created or received that has anything to do with the patient. This includes demographics as well as past, present or future health conditions. Specifically, anything that can be used to reasonably identify an individual or treatment. This includes, patient names, date-of-birth, carrier policy information, etc.  

Why do I need a contract with my Business Associates?

The reason behind the Privacy rule is to obtain assurances from your Business Associates that they will safeguard the Protected Health Information. This is now required in writing in the form of a contract, called Business Associate Agreement. To learn more about this ChiroCode ( has written a book called “Complete and Easy HIPAA Compliance”. The third edition was updated last year to include provisions of the Omnibus Final rule.  To order your book go to Your Business Associate Contracts must contain the elements specified at 45 CFR 164.504(e), such as describing the permitted and required uses of PHI by the associate, and that they will not use or disclose the PHI for anything other than as required by law. Also, if there is a breech the covered entity must make the appropriate steps to correct it. The contract must clearly state how the issue would be resolved.

Note that Business Associate Agreements are not necessary if the arrangement is for Treatment, Payment, or healthcare Operations (TPO). More specific information defining the TPO will be made available in an upcoming article.

Who is a covered entity?  

The HIPPA Privacy Rule only applies to covered entities – health plans, health care clearinghouses and certain health care providers.  

 Examples and potential Business Associates:

(This is not a complete list – Examples only)

Who is not a business associate?

(This is not a complete list – Examples only)

 An external researcher

 FAQ’s from

Q. Is a physician or other provider considered to be a business associate of a health plan or other payer?

A.  NO

Q. Is a software vendor a business associate of a covered entity?


Q. Instead of entering into a contract, can business associates self-certify or be certified by a third party as compliant with the HIPAA Privacy Rule?

A. NO 45 CFR 164.504(e).

Q. Do physicians with hospital privileges have to enter into business associate contracts with the hospital?


Q. Are accreditation organizations business associates of the covered entities they accredit?


Q. Is a health insurance issuer or HMO who provides health insurance or health coverage to a group health plan a business associate of the group health plan?


Q. Does a health care provider have to have a BAA with another provider?

A.  NO

Q. Is a business associate contract required for a covered entity to disclose protected health information to a researcher?


According to HIPAA, who are my Business Associates?. (2014, September 11). Find-A-Code Articles. Retrieved from

© InnoviHealth Systems Inc

Article Tags  (click on a tag to see related articles)

Publish this Article on your Website, Blog or Newsletter

This article is available for publishing on websites, blogs, and newsletters. The article must be published in its entirety - all links must be active. If you would like to publish this article, please contact us and let us know where you will be publishing it. The easiest way to get the text of the article is to highlight and copy. Or use your browser's "View Source" option to capture the HTML formatted code.

If you would like a specific article written on a medical coding and billing topic, please Contact Us.


innoviHealth Systems, Inc.
62 East 300 North
Spanish Fork, UT 84660
Phone: 801-770-4203 (8-5 Mountain)
free demo
request yours today
free subscription
for any budget

Thank you for choosing Find-A-Code, please Sign In to remove ads.