Should we require janitorial, equipment, etc. type contracts to have a BBA, included in bids and contracts?
(A): A BAA is not required if the service involves treatment. Further, a BAA is not required when the contracted services do not require that we provide and/or that the vendor use PHI in order to provide the contracted services. In such instances, access to protected health information by such persons would be incidental, if at all. Generally, janitorial, maintenance, etc. contractors are not Business Associates because the work they perform does not require that we provide access to PHI, and/or that the vendor use PHI in order to provide the contracted service. Any disclosure of PHI that occurs in the performance of their duties (e.g., emptying trash, cleaning offices, repairing light fixture, etc.) is limited in nature, occurs as a by-product of the contract service and could not be reasonably prevented. Such disclosures are “incidental” and permitted by the HIPAA Privacy Rule.
