Is a business associate contract required with organizations or persons where inadvertent contact with protected health information may result – such as in the case of janitorial services?
A business associate contract is not required with persons or organizations whose functions, activities, or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all. Generally, janitorial services that clean the offices or facilities of a covered entity are not business associates because the work they perform for covered entities does not involve the use or disclosure of protected health information, and any disclosure of protected health information to janitorial personnel that occurs in the performance of their duties (such as may occur while emptying trash cans) is limited in nature, occurs as a by-product of their janitorial duties, and could not be reasonably prevented. Such disclosures are incidental and permitted by the HIPAA Privacy Rule. See 45 CFR 164.502(a)(1). If a service is hired to do work for a covered entity where disclosure of protected health inf
Related Questions
- Is a business associate contract required with organizations or persons where inadvertent contact with protected health information may result - such as in the case of janitorial services?
- Is a BA contract required with organizations or persons where inadvertent contact with PHI may result such as in the case of janitorial services?
- Is a business associate contract required for a covered entity to disclose protected health information to a researcher?
