Disclosing Identity of Business Associates?

[Christine Roberts]

Is there any duty under HIPAA to disclose to group health plan participants the identity of business associates, for example a third party administrator maintaining a Web-based claims information center? More specifically, does the covered entity (plan sponsor) have to disclose the fact that it does not maintain the claims info center, that is otherwise designed and "branded" to appear that it is maintained by the plan sponsor alone.

[Steve72]

I don't think that the covered entity needs to identify the business associates.

The only complication I see is with regard to individual rights under HIPAA. Will participants be able to contact the BA directly to review their PHI, or will the employer act as intermediary?

I think either way is acceptable.