Do we need to obtain business associate agreements with janitorial services and copier services?
No. Although the individuals performing these services may be exposed to PHI, these exposures are considered “incidental disclosures” and are permitted under the HIPAA privacy regulations, as modified in August 2002, so long as provider offices take necessary precautions to minimize such incidental exposures.
