PubMed2002
The final rule implementing the privacy standards mandated by the Health Insurance Portability and Accountability Act (HIPAA) of 1996 imposes substantial requirements on covered entities with respect to their business associates--those parties providing certain services to, or on behalf of, the covered entities. A covered entity must develop a contract with each of its business associates that sets forth the conditions under which the business associate may use or disclose the protected health information it receives from the covered entity. The contract also must delineate the covered entity's obligations with respect to the business associate, which include ensuring individuals' access to their protected health information and taking certain steps to respond to a breach of the privacy standards by the business associate. The business associate requirements do not apply to the covered entity's workforce, disclosures to providers for treatment purposes, certain financial transactions, certain jointly administered government programs, and, provided that certain other restrictions are met, disclosures made by group health plans to plan sponsors.