In 2004, most health care providers will be required to sign Business Associate Agreements with almost every company with whom they share patient information. This will apply to a variety of vendors and services, including claims processing; Web services; billing; X-rays, MRIs; and other diagnostic imaging procedures.
The Health Insurance Portability and Accountability Act (HIPAA) requires that health care providers and insurance companies protect the privacy of patient information. As a part of that requirement, entities that do business together (such as insurance companies and doctors) and transmit information (in any form of transmission, paper included) are required to protect that information from disclosure by the receiving party, by requiring that party to enter into a business associate agreement.
You are likely to see numerous versions of the business associate agreements, each with terms and conditions that need to be considered, separately and within the context of the entire agreement.
Perhaps the least stringent type of business associate agreement is the sample released by the Department of Health and Human Services (HHS).1 However, even its version includes the following provisions in which you, the doctor, would be considered the "Business Associate" and the third-party payer would be considered the "Covered Entity":
Obligations and Activities of Business Associate
a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by the Agreement or as Required By Law.
b. Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement.
c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. [This provision may be included if it is appropriate for the Covered Entity to pass on its duty to mitigate damages to a Business Associate.]
d. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware.
e. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information.
f. Business Associate agrees to provide access, at the request of Covered Entity, and in the time and manner [Insert negotiated terms], to Protected Health Information in a Designated Record Set, to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR § 164.524 (of the HIPAA regulations). [Not necessary if business associate does not have protected health information in a designated record set.]
g. Business Associate agrees to make any amendment(s) to Protected Health Information in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR § 164.526 (of the HIPAA regulations) at the request of Covered Entity or an Individual, and in the time and manner [Insert negotiated terms]. [Not necessary if business associate does not have protected health information in a designated record set.]
h. Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Entity available [to the Covered Entity, or] to the Secretary (of Health and Human Services), in a time and manner [Insert negotiated terms] or designated by the Secretary, for purposes of the Secretary determining Covered Entity's compliance with the Privacy Rule.
i. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR § 164.528 (of the HIPAA regulations).
j. Business Associate agrees to provide to Covered Entity or an Individual, in time and manner [Insert negotiated terms], information collected in accordance with Section [Insert Section Number in Contract Where Provision (i) Appears] of this Agreement, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR § 164.528 (of the HIPAA regulations).
Privacy Rule. "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E (of the HIPAA regulations).
Protected Health Information. "Protected Health Information" shall have the same meaning as the term "protected health information" in 45 CFR § 164.501 (of the HIPAA regulations), limited to the information created or received by Business Associate from or on behalf of Covered Entity.
Required By Law. "Required By Law" shall have the same meaning as the term "required by law" in 45 CFR § 164.501 (of the HIPAA regulations).
It should be obvious from the above provisions that your office will be required to follow most HIPAA privacy requirements, even if you don't consider yourself a "covered entity." (Editor's note: See "Everything You Ever Wanted to Know About HIPAA [But May Still Be Afraid to Ask] in the January 2003 issue of Acupuncture Today.) This means you will want to have HIPAA privacy and administrative manuals in place for your practice before you sign any of these business associate agreements.
In addition to the above stipulations, the agreement will, at the very least, include the following:
A condition of indemnity will probably also be included in the business associate agreements you are asked to sign. Since there are serious penalties for violations of the HIPAA privacy provisions, you will be asked to "indemnify" or hold the other party harmless if something happens and fines are assessed, or if someone files a lawsuit.
ou should be particularly careful with indemnity clauses; they should not be one-sided. Whatever protection the other party expects from you, they should be willing to give. The language should be equal for both sides. Also, it should be clear that you are only responsible for actions in your control. You should not be asked to protect the other party against acts by third parties.
Finally, you need to be confident that your office has the appropriate HIPAA privacy manuals and is well-prepared to function in a manner that is HIPAA privacy-compliant and allows you to abide by the specific provisions from whom you are indemnifying the other party. This is your only real assurance that you won't inadvertently forget what you signed and face heavy penalties later.
The level and type of malpractice insurance you carry may also be part of the business associate agreement. We have already seen agreements that require you to carry "occurrence" type coverage at specified levels. If this is the case, you may have to change your insurance.
Another thing to consider is that your malpractice insurance will not generally cover violations of HIPAA privacy rules or business associate agreements. Unless there are mitigating circumstances, your policy will probably not protect you should you or one of your staff violate the privacy rules, or if you are found practicing without HIPAA privacy manuals. This is another reason to take these business associate agreements very seriously.
If you haven't gotten your first business associate agreement yet, you will soon. Don't assume they are all the same. Read each one, and don't be afraid to challenge provisions you feel are unfair and one-sided. If you are agreeing to abide by the HIPAA privacy laws, make sure you have HIPAA privacy and administration manuals specifically customized to your practice, and that your staff is following the new procedures.
Reference
Chronic pain afflicts over 20% of the adult population. Sadly, most MDs have essentially no education in treating pain, beyond offering a few toxic medications. Then they tend to steer people with pain away from those health practitioners who are trained. This puts the acupuncture community on the front lines for addressing this epidemic.
When the body is going through a stressful event, the sympathetic system is activated. This activation will help the body with a life-threatening situation. If this state is activated for prolonged periods of time, it starts to consume energy. These traumatic events that generate stressors in the autonomic nervous system (ANS) will eventually become internalized.
| Digital Exclusive
One of the things that makes acupuncture so difficult to measure is that the medicine actually does contain some esoteric aspects. There have been numerous studies that demonstrate the neurochemical reasoning behind why acupuncture points stimulate the autonomic nervous system to enact change However, not all the benefits of TCM can easily be measured by randomized, controlled trials. But does that make them fundamentally and definitively untrue?
| Digital Exclusive