To put it simply, a business partner is a person or organization that interacts with phi from a covered entity or other business partner. Answer: An affected company may treat an entrepreneur who has their workplace on-site at a covered company and who has more than just random access to protected health information, either as a staff member of the covered company or as a business partner within the meaning of HIPAA. General provision. The confidentiality rule requires that a covered entity receive satisfactory assurances from its business partner that the business partner is adequately protecting the protected health information it receives or creates on behalf of the covered entity. Satisfactory assurances must be given in writing, whether in the form of a contract or other agreement between the targeted entity and the business partner. 4. Health care providers who receive PSR to treat patients. A healthcare provider is not a business partner of other covered companies when treating patients. (See 45 CFR 160.103; see also 65 FR 82476 and 82504). As OCR explains, if the documents to be destroyed do not contain protected health information, the entity is not a business partner. We also clarify that the same interpretations that apply to determining whether a first-tier contractor is a business partner also apply to determining whether a subcontractor is a business partner. Thus, our interpretation of who is excluded from the definition of business partner as a conduit and who is not, also applies with regard to subcontractors.
We refer readers to the above discussion of services and transmission channels. A business partnership agreement is not required with a person or organization whose functions, activities or services do not involve the use or disclosure of [PHI] and where access to [PHI] by such persons would be accidental, if at all. [For example] concierge services that clean the offices or facilities of a covered company are not business partners, since the work they perform for the targeted companies does not involve the use or disclosure of [RPS], and any disclosure of [RPS] to janitorial staff that occurs in the performance of their duties (as may occur when emptying garbage cans), is limited in nature. occurs as a by-product of their custodial functions and could not reasonably be avoided. 1. Except in the cases provided for in paragraph 4 of this definition, consideration means a person who: 7. Entities that are only “channels” for PSR. Companies that submit PSR for a covered business are not business partners if they do not need systematic access to PSR, i.e. they are only “channels” of PSR (. B Internet service providers, telephone companies, etc.) .
. . .