Covered Entity v. Business Associate

[Guest irash]

Please help clarify the Privacy standards for me. I have a couple of questions that I cannot convince myself of the answer in reviewing the regulations.

1. Would a self-funded governmental (municipality) be considered a covered entity, provided all other requirements are met? Simply stated, are governmental/municipalities subject to this provision?

2. If a governmental/municipality is not subject, would a third party that meets the requirements of a Business Associate be required to present a Business Associate Contract to the plan?

3. Who has the responsibility to initiate Business Associate Contracts, the third party or the Covered Entity?

Thanks!

[Steve72]

1) There is no exception for governmental entities or municipalities. A municipal-sponsored health plan is a covered entity.

2) N/A. A covered entity must enter into a BAA with any third party that meets the definition of a business associate.

3) Business associates are not directly governed by the privacy rule (except in their covered function, if also a covered entity). The covered entity has the responsibility to ensure the contract is executed and is adequate.

However, this does not mean that business associates will not initiate this process. Entities that perform services as business associates are, for the most part, well aware of these rules, and are acting to ensure that they can continue to do business.