Requirement
Health plans, including the group health plans provided by employers, may not disclose protected health information to a “business associate” or allow a “business associate” to create or receive protected health information on behalf of the health plan unless the health plan has entered into a contract with the business associate that provides satisfactory assurances that the business associate will appropriately safeguard the protected health information.

Identifying Business Associates

1. A business associate is any person, other than a member of the health plan’s work force, who:
   

   1. On behalf of the health plan performs or assists with any activity involving protected health information, including activities such as claims processing or administration; data analysis, processing, or administration; utilization review; billing; benefit management; or repricing; or

   2. Provides any of the following services, where the providing the service involves disclosure of protected health information to the person: 1) legal, 2) actuarial 3) accounting, 4) consulting, 5) data aggregation, 6) management, 7) administrative, 8) accreditation and 9) certain financial services.

2. The following are not business associates:
   
   1. The employer/plan sponsor of a group health plan (separate contractual requirements apply to plan sponsors);
   2. A provider seeking reimbursement (unless the provider performs some function on behalf of the health plan, such as case management);
   3. A contractor that has de minimis contact with protected health information (for example, a janitorial service); or
      iv. An organization that acts merely as a conduit for information (for example, the U.S. Postal Service, FedEx, and telecommunications and internet service providers that act only as conduits).

Key Elements of a Business Associate Contract
Business associate contracts are required to have provisions that:

• Establish the permitted uses and disclosures of protected health information
• Provide that the business associate will not use or further disclose the information other than as allowed under the contract or required by law
• Provide that the business associate will use appropriate safeguards to prevent the unauthorized use or disclosure of information
• Require the business associate to report to the health plan any unauthorized uses or disclosures of the information
• Ensure that any agents or subcontractors to whom the business associate discloses protected health information agrees to these same restrictions
• Provide that the business associate will make protected health information available for inspection
• Provide that the business associate will make protected health information available to amend and that the business associate has the capacity to make amendments
• Provide that business associates can provide for an accounting all of their disclosures of protected health information
• Require that the business associate agrees to make its internal practices, books and record available to the Secretary of HHS for inspection, if necessary
• Provide that the business associate agrees to return or destroy, if feasible, all protected health information and if not feasible agrees to secure the information and limit future uses and disclosures to those purposes that made its return or destruction infeasible
• Authorize the termination of the contract if the business associate has violated a material term of the contract

A sample business associate contract can be found in the sample documents section of this guide.