TPA Obtains Authorizations?

[Christine Roberts]

My reading of the HIPAA regulations imposes the written authorization requirements on covered entities only.

However I understand that carriers are requiring TPAs to obtain authorization forms from individual participants in the group health plans they administer, in order to handle claims.

Wouldn't all TPA uses of PHI be covered under the business associate agreement with the covered entity, whether it be an insurance company or a self-funded plan?

[Jbentz]

I agree with you that the BA agreement should cover the TPA. I am finding that many of the CEs are still requiring written authorizations when they are not needed under HIPAA (payment and treatment.) With all the paperwork we now are required to do, I am reluctant to add any additional.