Is your firm a HIPAA business associate when it serves a medical practice?

Payment is in the definition. Health information isn't only a diagnosis. The definition reaches information that "Relates to ... the past, present, or future payment for the provision of health care to an individual" and "That identifies the individual". So a report that names a patient and shows what they were billed, paid or still owe describes health information. Protected health information is that information held or sent in any form.

Which files to look at. In an accounting engagement for a practice, the records most likely to carry it are patient ledgers, receivable reports that name patients, insurer remittances and patient-level deposit detail. A general ledger that shows revenue by month with no names is a different thing. The question for each engagement is whether the work "involves the disclosure" of records like the first group to your firm.

The definition describes; your counsel concludes. Nothing on this page decides whether your firm is a business associate. What it can do is show you the words the definition uses, so the conversation with counsel starts from the engagement letter, the files and what the practice actually sends.

The practice's own staff records may be outside it. The definition of protected health information excludes health information "In employment records held by a covered entity in its role as employer". A payroll engagement that touches only the practice's employees, as employees, may involve no protected health information at all. The word is may: the same office can hand a bookkeeper a patient deposit report in the same email as the payroll file.

Look at what arrives, not at the engagement's name. A firm that does payroll and bookkeeping for a practice should look at every file the practice sends, because the definition follows the information. Whether a particular engagement stays outside it is a question for counsel, and the honest answer may differ from one client to the next.

The agreement is the practice's duty, and your firm signs it. The practice may hand patient information to a business associate only with "satisfactory assurance" that it will be safeguarded, and 164.502(e)(2) says those assurances "must be documented through a written contract or other written agreement or arrangement". That document is the business associate agreement. It also sets what your firm may do with the information: under 164.502(a)(3) a business associate "may use or disclose protected health information only as permitted or required by its business associate contract or other arrangement ... or as required by law".

Section 164.504(e)(2) lists what the contract has to provide. The clauses that change how an accounting firm works are these:

1. "Not use or further disclose the information other than as permitted or required by the contract or as required by law;" (164.504(e)(2)(ii)(A))
2. "Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information, to prevent use or disclosure of the information other than as provided for by its contract;" ((ii)(B))
3. "Report to the covered entity any use or disclosure of the information not provided for by its contract of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410;" ((ii)(C))
4. Make sure any subcontractor that handles the information agrees "to the same restrictions and conditions that apply to the business associate with respect to such information;" ((ii)(D))
5. "At termination of the contract, if feasible, return or destroy all protected health information" the firm still holds, or extend the contract's protections to what cannot be returned ((ii)(J))
6. "Authorize termination of the contract by the covered entity, if the covered entity determines that the business associate has violated a material term of the contract." ((iii))
7. "Report to the covered entity any security incident of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410." (164.314(a)(2)(i)(C), for electronic records)

Read the one you are handed. Most practices send a template. The clauses above are the floor the rule sets. A template can add to them: a shorter reporting deadline than 60 days, a named security contact, a right to inspect. Your firm should know what it signed, and the partner who signed it should be able to find it. Claremont drafts no agreements; the wording comes from the practice or from your lawyer.

A subcontractor is anyone you hand the work to. The rule defines a subcontractor as "a person to whom a business associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate", and paragraph (3)(iii) makes a subcontractor that handles protected health information a business associate itself. For an accounting firm that means the company that hosts its files, the outsourced IT provider with admin access, and any service that processes the practice's records for the firm.

You need assurances from them, in writing. Under 164.502(e)(1)(ii) a business associate may pass protected health information to a subcontractor "if the business associate obtains satisfactory assurances ... that the subcontractor will appropriately safeguard the information", and 164.308(b)(2) says the same for electronic records. The assurances are documented the same way, in a written agreement. So the chain runs practice to firm to vendor, with a document at each link.

No vendor is named here. Which of your vendors will sign one, and on what terms, is a question for each vendor. None of their agreements has been read for this page, so it says nothing about any of them.

The Security Rule names business associates directly. Section 164.104(b) says the standards "apply to a business associate" where provided, and 164.302 provides it for the whole Security Rule, subpart C. That is a duty of your firm's own, under the regulation, separate from the agreement.

The first required step is a risk analysis. Section 164.308(a)(1)(ii)(A) is marked Required: "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate." For a firm that already does a risk assessment under the FTC Safeguards Rule, the electronic patient records become one more thing it has to cover.

Size and cost count. The rule lets a firm choose its measures, and in choosing them it "must take into account" four factors under 164.306(b)(2), the first of which is "The size, complexity, and capabilities of the covered entity or business associate" and the third "The costs of security measures". A fifteen-person firm is not held to a hospital's program. It is held to a reasoned one, written down.

The paper is kept six years. Policies and procedures go "in written (which may be electronic) form", and 164.316(b)(2)(i) says to "Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later." That is longer than anything the FTC rule asks a tax firm to keep about its program.

Your notice goes to the practice. A business associate that discovers a breach of unsecured protected health information notifies the covered entity. The 60 calendar days run from the first day anyone at your firm, other than the person who caused it, knew or should have known, under 164.410(a)(2). The practice then owes the notices to patients, HHS and the media on its own clock. Our brief A practice finds a breach of patient data: who does it tell, and by when? covers that side.

Name the people. The notice includes "to the extent possible, the identification of each individual" affected, under 164.410(c)(1), and any other information the practice needs for its letters, "at the time of the notification ... or promptly thereafter as information becomes available". A firm that can't say which patients were in a file it lost has a bigger problem than the deadline.

It sits beside the FTC clock. For a tax firm, the same incident can also be a notification event under the FTC Safeguards Rule, which runs 30 days from discovery at 500 or more consumers. The breach deadline calculator prints both, with the HIPAA business associate notice turned on for the firm that needs it.

The FTC rule still reaches the tax work. Nothing in HIPAA switches the Safeguards Rule off. A firm that prepares income tax returns is a financial institution under 314.2(h)(2)(viii), and its customer information is covered whatever else the firm does. The practical answer is one program that satisfies both, with the patient records called out in the risk assessment and the two notice clocks in the incident plan. Our brief What does an affiliated investment adviser add to a CPA firm's obligations? works through the same problem for a firm with an investment adviser attached.

Wisconsin's carve-out names covered entities, not business associates. Wis. Stat. 134.98(3m)(b) says the state breach statute does not apply to "An entity that is described in 45 CFR 164.104 (a), if the entity complies with the requirements of 45 CFR part 164." Paragraph 164.104(a) lists health plans, clearinghouses and providers; business associates are in 164.104(b). So that paragraph doesn't describe your firm, and your Wisconsin question stays where it was: on the GLBA carve-out in (3m)(a) and on counsel.