Is a BA contract required with organizations or persons where inadvertent contact with PHI may result such as in the case of janitorial services?
A business associate contract is not required with persons or organizations whose functions, activities, or services do not involve the use or disclosure of PHI, and where any access to PHI by such persons would be incidental, if at all. Generally, janitorial services that clean the offices or facilities of a covered entity are not business associates because the work they perform for covered entities does not involve the use or disclosure of PHI, and any performances of their duties is limited in nature, occurs as a by-product of their janitorial duties, and could not be reasonable prevented. If a service is hired to do work for a covered entity where disclosure of PHI is not limited in nature, it likely would be a business associate. However, when such work is performed under the direct control of the CE, the Privacy Rule permits the CE to treat the service as part of its workforce, and the CE need not enter into a BA contract with the service.
Related Questions
- Is a business associate contract required with organizations or persons where inadvertent contact with protected health information may result – such as in the case of janitorial services?
- Is a business associate contract required with organizations or persons where inadvertent contact with protected health information may result - such as in the case of janitorial services?
- Is a BA contract required with organizations or persons where inadvertent contact with PHI may result such as in the case of janitorial services?
