Q&A: Healthcare providers and business associates

Q: Can a healthcare provider be a business associate (BA) of another provider? In other words, do providers need to have business associate agreements (BAA) between one another?

A: Yes, Provider 1 may be a BA of Provider 2, if it provides a service to Provider 2 that requires access to Provider 2’s PHI. In this case, Provider 2 would need to have a BAA with Provider 1. Providers who exchange PHI in the course of providing treatment for shared patients do not need to have BAAs with each other.

Editor’s note: This question was answered by Mary D. Brandt, MBA, RHIA, CHE, CHPS. Brandt is a healthcare consultant specializing in healthcare regulatory compliance and operations improvement. She is also an advisory board member for BOH. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are those of the author and do not represent HCPro or ACDIS.