HIPAA Rules tend to address two specific groups: covered entities and business associates. Which group are you in?
Covered Entities
Covered entities are those who provide health care to patients, health plans who insure patients, clearinghouses that process information for a healthcare provider HIPAA Compliance Service, and in the Security Rule, Medicare prescription drug card sponsors.
Business Associates
Business associates provide services for covered entities. This could be an attorney for a hospital or physician, a coding and billing service, or a medical transcription service.
What about Independent Contractors?
Independent contractors are really business owners, you just have a business of one. If you are an independent contractor, you could be a business associate, if you provide services direct to the covered entity. What that means is if you are a medical transcriptionist and you provide transcription services for a doctor or hospital, you are a business associate. If, however, you are a medical transcriptionist who contracts with a medical transcription service, you are not a business associate, but a subcontractor. Be sure you know which role applies to you because it impacts what you have to do to be compliant.
What About Employees?
If you are an employee of a covered entity, you are a part of what is known as the “workforce.” Workforce is defined as employees and paid or unpaid volunteers, trainees, and other personnel whose conduct in the performance of work for a covered entity is under the direct control of that entity. The term does not include independent contractors, who are considered business associates.
Doesn’t HITECH change all of this?
With the introduction of the HITECH Act, some medical transcription services, in an effort to figure out how it all applies to them, are now calling themselves a covered entity. This is not the case. The definition of these two groups has not changed. What has changed is how the rules apply to each group. If you have a medical transcription service and provide services for a covered entity, you are still their business associate. The difference now is that you must follow the privacy and security rules just like a covered entity must follow them. Your status did not change, however, the application of the rules DID change to impact how you do business.
Does It Really Matter?
Medical transcriptionists who work as independent contractors have often been classified as a subcontractor, an agent, and even a business associate. Prior to the changes that have been brought about with the HITECH Act, perhaps it didn’t matter. With the new rules and regulations, it absolutely does matter. Be careful to not let someone classify you as a business associate unless that is really your role. If you are a transcription service owner, don’t fall into the trap of classifying yourself as a covered entity just because the rules now say you have to do all of the same things. Having the correct classification can save you a lot of headaches down the line so be sure you have it right. Remember that the law now requires audits be done. If you find yourself misclassified as a business associate or a covered entity, you could find the Department of Health and Human Services on your doorstep asking to see all of your written policies and procedures and proof of your risk analysis. It DOES matter.
Determining what group you are in is the first step toward understanding your responsibilities for being compliant. It gives you the starting point for the road map that is called HIPAA Compliance.