Question: We want to hire a company to transport patients to and from other medical facilities for treatment. The taxi service would have access to patients' names, addresses and other information needed to identify and bill for their work (including Social Security numbers). Should we sign a business associate agreement with the company or do we need to ask patients to authorize the disclosure of their information to the company? Answer: "It depends on whether the company is working on your behalf," says attorney Ann Bittinger of Jacksonville, FL's Bittinger Law.
Tennessee Subscriber
Important: If you shop out a service that you would normally do for yourself, the company providing the service falls under the business associate umbrella, Bittinger explains. But, if the service isn't part of your standard operations, then a business associate agreement won't cover your obligations, she says.
The bottom line: Instead of a business associate agreement, "you need each patient's authorization before you can release their PHI," Bittinger says. Good idea: Ask patients to authorize your disclosure of their PHI to the taxi company when you offer them the service.