Don’t sweat it if you’ve been sending claims with protected health information in the mail and don't have a HIPAA business associate (BA) agreement with the U.S. Postal Service. The Department of Health and Human Services says that covered entities (CEs) do not need to enter into BA agreements or contracts with couriers or other “conduits,” which HHS says also includes electronic equivalents.
“A conduit transports information but does not access it other than on a random or infrequent basis as necessary for the performance of the transportation service or as required by law,” HHS says in a Frequently Asked Question on its website. “Since no disclosure is intended by the covered entity, and the probability of exposure of any particular protected health information to a conduit is very small, a conduit is not a business associate of the covered entity.”