HIPAA Privacy The Morning After HIPAA Summit West HIPAA Privacy The Morning After What do we do now? Tina H.Sernick, Manager Deloitte and Touche 2 World Financial Center New York, NY 10281-1414 212 436-5438 tsernick@deloitte.com

IDENTIFYING YOUR BUSINESS ASSOCIATES AND TRADING PARTNERS ON AN ONGOING BASIS On an ongoing basis, establish a mechanism to: 1. Identify third parties that receive protected health information from your organization or that exchange electronic information with your organization as part of an electronic transaction. 2. Maintain a system for identifying agreements that may be coming up for renewal and which will require the inclusion of business associate provisions in the agreement. 3. Review a representative sampling of such agreements including terms of confidentiality provisions incorporated therein. 4. Flag all new outside vendor relationships or other third party relationships to determine whether a business associate agreement or trading partner agreement (or both) is necessary once the relationship is established.

Key Terms BA- Business Associate CE-Covered Entity CH-Health Care Clearinghouse GHP-Group Health Plan HP-Health Plan PHI-Protected Health Information PHO-Physician Health Organization PR-Provider TPO-Treatment Payment Health Care Operations TR-Trading Partner SHI-Summary Health Information

Identifying Business Associate Relationships on an Ongoing Basis Describes a basic clearinghouse relationship CE BA P CE Proprietary ANSI PHI PHI Other Health Plans Providers CE Clearinghouse CH PR HP TP

Identifying Business Associate and Trading Partner Relationships Describes a basic clearinghouse relationship in which the health care clearinghouse is providing services to both a provider and to a health plan Providers PR CE PHI Clearinghouse BA P HP Proprietary ANSI CH TP TP

Identifying Business Associate and Trading Partner Relationships Describes the relationship between specialty vendors that contract with a GHP to arrange for and manage specialty care delivered to members. Specialty vendors may handle referrals, credential providers, handle case management, or provide pharmacy services, but do not directly deliver care to plan participants. BA Members/ Patients CE CE TPO TPO Specialty Vendors PHI PHI TPO Specialty Providers PHI HP PR

Identifying Business Associate and Trading Partner Relationships Illustrates a fully insured relationship in which the Employer Group Health Plan Sponsor purchases an insured product from an insurance company or other insuring organization (e.g., an HMO) Employer Providers HP Release PHI only if there is certification that plan documents meet requirements of [164.504 (f)(2)] PR CE PS GHP Purchaser Plan Documents PHI TPO Enrollment Data, Premium Payments EXAMPLE

Identifying Business Associate and Trading Partner Relationships Illustrates a relationship in which an Employer Group Health Plan Sponsor contracts with an unrelated entity (e.g., Hewitt, Fidelity, etc.) to perform Plan Sponsor duties such as enrollment and premium payments Employer Release PHI only if there is certification that plan documents meet requirements of [164.504 (f)(2)] CE PS GHP Purchaser Plan Documents PHI Enrollment Data, Premium Payments Vendor Enrollment EXAMPLE

Identifying Business Associate and Trading Partner Relationships Illustrates a self-insured relationship in which an Employer Group Health Plan Sponsor contracts with an unrelated entity (i.e., a TPA) to perform functions on behalf of the Group Health Plan such as claims processing, customer service, etc. Administrative services may be provided by a stand-alone TPA or a TPA that is a Covered Entity in its own right (e.g., an insurance company) Release PHI only if there is certification that plan documents meet requirements of [164.504 (f)(2)] Providers PR CE PS GHP Purchaser Plan Documents BA PHI Employer TPA Vendor or Enrollment Data Claims Processing, Customer Service, etc. TPO EXAMPLE

Identifying Business Associate and Trading Partner Relationships Illustrates a self-insured relationship in which an Employer Group Health Plan Sponsor contracts with an unrelated entity (e.g., Hewitt, Fidelity, etc.) to perform Plan Sponsor duties such as enrollment and also contracts with a TPA to perform functions such as claims processing on behalf of the Employer Group Health Plan EXAMPLE CE Vendor Enrollment Data Plan Documents Enrollment Data GHP PHI Employer BA CE CE TPO Purchaser Claims Processing, Customer Service, etc. or PS PHI TPA Vendor Providers PHI PR Release PHI only if there is certification that plan documents meet requirements of [164.504 (f)(2)]

Identifying Business Associate and Trading Partner Relationships Describes the relationship between Physician Hospital Organization, other health insurance issuers or health plans, and the GHP OHCA CE TPO CE Members/ Patients PHI PR CE PHO HP BA