To the extent that counties are covered by HIPAA, who are their business associates?
A business associate relationship exists when an entity acts on the behalf of a covered entity in the performance of an administrative function involving the use or disclosure of protected health information (PHI). A covered entity that shares PHI with another entity for treatment purposes does not establish a business associate relationship. Whether a county has a business associate relationship with another entity depends on the HIPAA status of the county in the situation and the nature of the business conducted between the two parties. Counties can have three statuses under HIPAA.
