Covered Entities & Business Associates

Covered Entities encompass health plans, healthcare clearing houses, and healthcare providers that electronically transmit any form of health information included under US Department of Health & Human Services standards. A Business Associate is any organisation or person working with, or providing services to, a Covered Entity that handles or discloses Personal Health Information (PHI) or Personal Health Records (PHR).

Individuals, organisations, and agencies meeting the definition of a Covered Entity under HIPAA must protect the privacy and security of health information and provide individuals with certain rights with respect to their health information. If a Covered Entity engages a Business Associate to help it carry out its healthcare activities and functions, it must have a written Business Associate contract to ensure the Business Associate also complies with the Rules’ requirements.

How does this apply to Aculab

The PMA and EHR services provided by Aculab’s customers clearly include management and administration services, both of which are included in the list of services identified in the Privacy Rule, and the transmission of e-PHI. Customers use Aculab Cloud for a variety of solutions, including those involving patient management, advisory, care, diagnosis, results, rehabilitation, messenger, and information systems. Aculab, as the operator of Aculab Cloud is not a Covered Entity and Aculab’s healthcare customers may not be Covered Entities. However, an Aculab customer performing functions or activities that involve the use or disclosure of e-PHI, by providing services to a Covered Entity is, by definition, a Business Associate.

The relationship between a Covered Entity and a Business Associate is through a BAA. In the case of a service provider to a Business Associate, the service provider becomes a Business Associate and, for the purpose of the BAA, the other party becomes a Covered Entity. That means Aculab is the Business Associate and its customer is the Covered Entity.