Is a business associate contract required for a covered entity to disclose protected health information to a researcher?
No. Disclosures from a covered entity to a researcher for research purposes do not require a business associate contract, even in those instances where the covered entity has hired the researcher to perform research on the covered entitys own behalf. A business associate agreement is required only where a person or entity is conducting a function or activity regulated by the Administrative Simplification Rules on behalf of a covered entity, such as payment or health care operations, or providing one of the services listed in the definition of “business associate” at 45 CFR 160.103. However, the HIPAA Privacy Rule does not prohibit a covered entity from entering into a business associate contract with a researcher if the covered entity wishes to do so. Notwithstanding the above, a covered entity is only permitted to disclose protected health information to a researcher as permitted by Rule, that is, with an individuals authorization pursuant to 45 CFR 164.508, without an individuals aut
Related Questions
- May a covered entity share protected health information directly with another covered entity’s business associate?
- Is a business associate contract required for a covered entity to disclose protected health information to a researcher?
- Is a business associate contract required for a covered entity to disclose PHI to a researcher?
