Must a copy service serving a SDT or Authorization on a medical facility sign a Business Associate contract with the medical facility?
No. A Business Associate contract is used when the medical facility contracts with a copy service to perform services for them. Under HIPAA regulation CFR 164.502 it lists various scenarios and what is needed for each. SDTs and Auths fall under subsection (a) – standard disclosure. BA Contracts fall under subsection (e). See our letter (Acrobat document) for more details.