--- title: HIPAA Privacy and Business Associates in a Nutshell description: It is a physician’s duty not to disclose private medical records and now “business associates” must also comply with the privacy requirements of HIPAA. --- [![Goosman Lawfirm](https://blog.goosmannlaw.com/hs-fs/hubfs/Goosmannlaw%20October2017/images/Goosmann_Law_Firm_logo_4C-white.png?width=1250&name=Goosmann_Law_Firm_logo_4C-white.png "Goosman Lawfirm")](http://goosmannlaw.com/) - [COVID-19 Toolbox](https://goosmannlaw.com/covid-19-resource-toolbox/) - Our Team - [Attorneys](https://goosmannlaw.com/attorneys/) - [Non-Attorney Staff](https://http://goosmannlaw.com/non-attorney-staff/) - Practices & Industries - [Practices](https://goosmannlaw.com/practices/) - [Banking & Finance](https://goosmannlaw.com/banking-finance/) - [Bankruptcy, Restructuring & Workouts](https://goosmannlaw.com/bankruptcy-restructuring-workouts/) - [Business](https://goosmannlaw.com/business/) - [Divorce & Family Law](https://goosmannlaw.com/divorce-family-law/) - [Employment](https://goosmannlaw.com/employment-law/) - [Environmental, Health & Safety](https://goosmannlaw.com/health-safety/) - [Estate Planning](https://trustlawcounsel.com) - [Gestational Surrogacy & Adoption](https://goosmannlaw.com/gestational-surrogacy-adoption/) - [International Law](http://goosmannlaw.com/international-law/) - [Litigation / Trial Law](https://goosmannlaw.com/litigation-trial-law/) - [Local Counsel](https://http://goosmannlaw.com/local-counsel/) - [Mergers & Acquisitions](https://goosmannlaw.com/mergers-acquisitions/) - [Rapid Response](https://goosmannlaw.com/rapid-response/) - [Industries](https://goosmannlaw.com/industries/) - [Agribusiness & Cooperatives](https://goosmannlaw.com/agribusiness-cooperatives/) - [Construction](https://goosmannlaw.com/construction/) - [Cyber Law and Telecommunications](https://goosmannlaw.com/cyber-law/) - [Education](https://goosmannlaw.com/education/) - [Health Care](https://goosmannlaw.com/health-care/) - [Manufacturing](https://goosmannlaw.com/manufacturing-law/) - [Multifamily Housing](https://goosmannlaw.com/multifamily-housing-law/) - [Non-Profit & Tax Exempt Organizations](https://goosmannlaw.com/non-profit-law/) - [Real Estate](https://goosmannlaw.com/real-estate/) - [Transportation](https://goosmannlaw.com/transportation/) - [Tribal](https://goosmannlaw.com/tribal/) - Our Firm - [Firm News](https://blog.goosmannlaw.com/firm-news) - Careers - [Attorneys](https://goosmannlaw.com/careers/attorneys/) - [Administration](https://goosmannlaw.com/careers/administration/) - [Internships](https://goosmannlaw.com/careers/internships/) - [Client Testimonials and Results](https://goosmannlaw.com/our-firm/client-testimonials-and-results/) - [Culture, Diversity, and Community](https://http://goosmannlaw.com/our-firm/culture-diversity-and-community/) - [Women-Owned Business](https://goosmannlaw.com/our-firm/women-owned-business/) - [Associations & Memberships](https://goosmannlaw.com/associations-memberships/) - [Firm History](https://goosmannlaw.com/firm-history/) - Blogs - [CEO Law Review](https://blog.goosmannlaw.com/ceo-on-your-side) - [Construction Lawyer](https://blog.goosmannlaw.com/construction-lawyer-on-your-side) - [Cyber Lawyer](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side) - [Deal Maker](https://blog.goosmannlaw.com/deal-maker-on-your-side) - [Divorce Docket](https://blog.goosmannlaw.com/divorce-lawyer-on-your-side) - [Food for Thought](https://blog.goosmannlaw.com/agricultural-lawyer-on-your-side) - [HR Legal Insider](https://blog.goosmannlaw.com/human-resources-on-your-side) - [Law Doc](https://blog.goosmannlaw.com/health-lawyer-on-your-side) - [Paralegal Review](https://blog.goosmannlaw.com/paralegal-review/) - [Real Estate Lawyer](https://blog.goosmannlaw.com/real-estate-lawyer-on-your-side) - [Risky Business](https://blog.goosmannlaw.com/risk-manager-on-your-side) - [The Banker’s Suit](https://blog.goosmannlaw.com/banking-lawyer-on-you-side) - [Trial Law Review](https://blog.goosmannlaw.com/trial-lawyer-on-you-side) - [Trust Law Counsel](https://blog.goosmannlaw.com/estate-planning-laywer-on-your-side) - Resources - [COVID-19 Resource Toolbox](https://goosmannlaw.com/covid-19-resource-toolbox/) - [Podcast](http://podcast.goosmannlaw.com/) - [Videos](https://goosmannlaw.com/videos/) - [FREE eBooks & Tools](https://goosmannlaw.com/free-ebooks-tools/) - Contact Us - [Office Locations](https://goosmannlaw.com/locations/) - [Sioux City Law Firm](https://goosmannlaw.com/locations/sioux-city-law-firm/) - [Sioux Falls Law Firm](https://goosmannlaw.com/locations/sioux-falls-law-firm/) - [Omaha Law Firm](https://goosmannlaw.com/locations/omaha-law-firm/) - [Spirit Lake & Spencer Law Firms](https://goosmannlaw.com/locations/spirit-lake-and-spencer-law-firm/) - [Real Estate Closings Office](https://goosmannlaw.com/locations/real-estate-closing-office/) - [Submit a Testimonial](https://goosmannlaw.com/submit-a-testimonial/) - [Sign Up for Our Newsletter](https://goosmannlaw.com/sign-up-for-our-newsletter/) - [Pay Online](https://goosmannlaw.com/pay-online-3/) - [  (855) 843-4531](tel:855-843-4531) ![](https://blog.goosmannlaw.com/hubfs/Blog_Images/Lockbox%20Lawyer/close-button.png) [tel:855-THE-GLF1](tel:855-THE-GLF1) [Health Lawyer](https://blog.goosmannlaw.com/health-lawyer-on-your-side/topic/health-lawyer) # [HIPAA Privacy and Business Associates in a Nutshell](https://blog.goosmannlaw.com/health-lawyer-on-your-side/health-hipaa-privacy-and-business-associates-in-a-nutshell) By [Goosmann Law Team](https://blog.goosmannlaw.com/health-lawyer-on-your-side/author/goosmann-law-team)   |  6, March 2015 [READ NOW](https://blog.goosmannlaw.com/health-lawyer-on-your-side/health-hipaa-privacy-and-business-associates-in-a-nutshell) [Read Post](https://blog.goosmannlaw.com/health-lawyer-on-your-side/health-hipaa-privacy-and-business-associates-in-a-nutshell#article) [![](https://blog.goosmannlaw.com/hs-fs/hubfs/Logos/Logo1.jpg?width=60&name=Logo1.jpg)](https://blog.goosmannlaw.com/health-lawyer-on-your-side/author/goosmann-law-team) [Goosmann Law Team](https://blog.goosmannlaw.com/health-lawyer-on-your-side/author/goosmann-law-team)  Tags: [Health Lawyer](https://blog.goosmannlaw.com/health-lawyer-on-your-side/topic/health-lawyer) When most people hear about [Health Insurance Portability and Accountability Act](http://www.hhs.gov/ocr/privacy/) (HIPAA) and privacy of health records, they consider a physician’s duty not to disclose private medical records. Although HIPAA originally applied only to “covered entities,” which includes health plans, health care clearing houses and health care providers who transmit health information in electronic form, the privacy rules have expanded significantly in recent years and now “business associates” must also comply with the privacy requirements of HIPAA. ## **Who Is a “Business Associate?”** A “business associate” is a person or entity that performs functions or activities that involve the “use or disclosure of protected health information on behalf of, or provides services to, a covered entity.” Examples of business associates include: 1. Third-party administrators who assist in claims processing for a health plan. 2. CPA firms who have access to protected health information as a result of accounting services. 3. Attorneys who have access to protected health information while providing legal services to a health plan. 4. A consultant performing a utilization review for a hospital. 5. An independent medical transcriptionist who provides transcription services for a covered entity. Under HIPAA, a covered entity may only utilize a business associate, and provide that business associate with private health information, to help the covered entity carry out its health care functions. ## **Business Associate Contracts** HIPAA requires that there be a written contract with each business associate that is handling protected health information (PHI). The written contract must: 1. Establish the permitted and required uses and disclosure of PHI by the business associate. 2. Provide that the business associate will not use or further disclose the information other than is permitted by the contract or by law. 3. Require that the business associate implement appropriate safeguards to prevent unauthorized use or disclosure of PHI. 4. Require that the business associate disclose any unauthorized breach of PHI. 5. Require that the business associate complies with all provisions of the HIPAA privacy rule and the security rule. 6. Require that the business associate makes its internal policies and procedures available to the Department of Health and Human Services to ensure that it is complying with HIPAA regulations. 7. Require that the business associate return or destroy all protected health information at the conclusion of the contract. Business associate contracts should be reviewed and renewed annually to ensure that they are in compliance with current HIPAA regulations. There should always be a valid signed contract between a covered entity and any business associate that is handling protected health information. For more information about HIPAA privacy and business associates, contact the [Goosmann Law Firm](http://goosmannlaw.com) at [info@goosmannlaw.com](mailto:info@goosmannlaw.com) or (712) 226-4000. ### Select Different CTA for each Post from Blog Editor [![New Call-to-action](https://no-cache.hubspot.com/cta/default/489404/a8cefc17-3b9d-4de0-89cd-e60a64752422.png)](https://cta-redirect.hubspot.com/cta/redirect/489404/a8cefc17-3b9d-4de0-89cd-e60a64752422) ### Subscribe Our Blog Thanks for submission!! - Recent - Popular ### Posts by Topic - [Health Lawyer (18)](https://blog.goosmannlaw.com/health-lawyer-on-your-side/topic/health-lawyer) - [CMS (1)](https://blog.goosmannlaw.com/health-lawyer-on-your-side/topic/cms) - [CPC (1)](https://blog.goosmannlaw.com/health-lawyer-on-your-side/topic/cpc) - [Firm News (1)](https://blog.goosmannlaw.com/health-lawyer-on-your-side/topic/firm-news) - [MACRA (1)](https://blog.goosmannlaw.com/health-lawyer-on-your-side/topic/macra) - [Medicare Overpayments (1)](https://blog.goosmannlaw.com/health-lawyer-on-your-side/topic/medicare-overpayments) DISCLAIMER: The information in this blog post (“post”) is provided for general informational purposes only, and may not reflect the current law in your jurisdiction. By visiting this website, blog, or post you understand that there is no attorney client relationship between you and the Goosmann Law Firm attorneys and website publisher. No information contained in this post should be construed as legal advice from Goosmann Law Firm, PLC, or the individual author, nor is it intended to be a substitute for legal counsel on any subject matter. No reader of this post should act or refrain from acting on the basis of any information included in, or accessible through, this Post without seeking the appropriate legal or other professional advice on the particular facts and circumstances at issue from a lawyer licensed in the recipient’s state, country or other appropriate licensing jurisdiction. #### Let Us Know What You Thought about this Post. Put your Comment Below. [Previous Post](https://blog.goosmannlaw.com/health-lawyer-on-your-side/health-government-prepares-implement-penalties-doctors-using-paper-medical-records) ##### [Government Prepares to Implement Penalties for the Doctors Using Paper Medical Records](https://blog.goosmannlaw.com/health-lawyer-on-your-side/health-government-prepares-implement-penalties-doctors-using-paper-medical-records) [Next Post](https://blog.goosmannlaw.com/health-lawyer-on-your-side/health-medicare-to-cover-lung-cancer-screenings) ##### [Medicare to Cover Lung Cancer Screenings](https://blog.goosmannlaw.com/health-lawyer-on-your-side/health-medicare-to-cover-lung-cancer-screenings) ### Contact Info **Sioux City Location** P. 712-226-4000 F. (712) 224-4517 **Sioux Falls Location** P. (605) 371-2000 F. (605) 275-2039 **Omaha Location** P. (402) 280-7648 F. (402) 505-3967 --- [Disclaimer](http://goosmannlaw.com/list-all-blogs/disclaimer/) | [Privacy Policy](http://goosmannlaw.com/privacy-policy/) ### Locations **Sioux City Location** 410 5th Street Sioux City, IA 51101 **Sioux Falls Location** 5010 S. Minnesota Avenue, Suite 100 Sioux Falls, SD 57108 **Omaha Location** Advent Building 17838 Burke Street, Suite 250 Omaha, NE 68118 ![Goosmann](https://blog.goosmannlaw.com/hs-fs/hubfs/Blog_Images/Lockbox%20Lawyer/goosmann-white.png?width=250&name=goosmann-white.png "Goosmann") Goosmann Law Firm is a FULL SERVICE LAW FIRM with locations in Sioux City, Iowa, Sioux Falls, South Dakota, and Omaha, Nebraska. Goosmann Law attorneys are licensed to practice in Iowa, Nebraska, South Dakota, and North Dakota. Their attorney team's practices and industries include but are not limited to Agribusiness and Cooperatives, Banking and Finance, Bankruptcy, Restructuring and Workouts, Business, Construction, Cyber Law and Telecommunications, Divorce and Family Law, Education, Employment, Environmental Health and Safety, Gestational Surrogacy and Adoption, Health Care, Litigation and Trial Law, Manufacturing, Mergers and Acquisitions, Municipal, Nonprofit and Tax Exempt Organizations, Real Estate, and Transportation, Tribal, Wills, Trusts, Estate Planning, and Probate Law. Goosmann © Copyright 2017