HIPAA Privacy and Security
What is HIPAA Privacy and Security?
The HIPAA Privacy Rule provides federal protections for Personal Health Information (PHI) held by covered entities, and gives patients an array of rights with respect to that information. In addition, the Privacy Rule is balanced so that it permits the disclosure of PHI needed for patient care and other important purposes.
The HIPAA Security Rule specifies a series of administrative, physical, and technical safeguards for covered entities to use to assure the confidentiality, integrity, and availability of electronic Protected Health Information (ePHI). The HITECH Act, which is an addition to the overall HIPAA mandates, holds business associates responsible for being compliant with the HIPAA Privacy Rule and Security Rule.
The HITECH Act also mandates the Business Associate’s responsibility for holding the covered entity to the Business Associate contract and the HIPAA Privacy Rule and Security Rule. If the Business Associate becomes aware of any non-compliance by the Covered Entity, the business associate must fix the breach, terminate the Business Associate contract, and/or report the non-compliance to the Department of Health and Human Services (HHS).
In order to fulfill HIPAA regulations, Business Associates have to comply with the HIPAA Privacy Rule and Security Rule effective February 17, 2012.
Office Ally is a clearinghouse Covered Entity under HIPAA, providing Business Associate services.
What are Covered Entities and Business Associates?
Covered Entities include:
- Health Plans
- Health Care Clearinghouses, and
- Health Care Providers who transmit any health information in electronic form in connection with a transaction covered by HIPAA (such transactions mostly relate to payment)**
** The HIPAA Privacy and Security Rules require Covered Entities and their Business Associates to maintain the confidentiality and the security of protected health information (“PHI”) and electronic PHI (“ePHI”).
Business Associates are third parties (not employees of a Covered Entity) that create, receive, maintain, or transmit PHI in the course of providing administrative (not health care) services for or on behalf of a Covered Entity. Examples of Business Associate services include:
- Claims processing or administration
- Data analysis, processing or administration
- Utilization review
- Quality Assurance
- Patient Safety Activities
- Billing
- Benefit management
- Practice management
- Repricing
Accountants, EMR vendors, health care attorneys, health information exchange organizations, medical billing companies, and medical record storage companies are some examples of Business Associates. All of these companies provide services to Covered Entities which require the Covered Entity to disclose PHI to the Business Associate to enable the Business Associate to perform its services.
Office Ally is a health care clearinghouse that acts as a Business Associate when it provides clearinghouse functions to health plans and health care providers. In other situations, if Office Ally stores or de-identifies PHI for a client that is a Covered Entity or a Business Associate, Office Ally is acting as a Business Associate or Business Associate Subcontractor, respectively, of that Covered Entity or Business Associate.
What is a Business Associate Agreement?
The Business Associate Agreement (BAA) is Office Ally’s contract between the Covered Entity (the User) and the Business Associate (Office Ally) to ensure the protection of privacy and security of the PHI (ePHI) the User sends to Office Ally. The HIPAA Privacy and Security Rule require a contract of this kind.
The user (Covered Entity) must have a fully executed Office Ally Business Associate Agreement (BAA) on file with Office Ally in order to utilize Office Ally services.
What are the Obligations of Office Ally (Business Associate)?
The Business Associate Agreement (BAA) stipulates the requirements and limitations on how PHI (ePHI) is handled by Office Ally (Business Associate). Office Ally is a clearinghouse Covered Entity under HIPAA, providing Business Associate services.
Limitations on Use and Disclosures
- The BAA specifically limits what Office Ally (Business Associate) can do with PHI (ePHI) that has been received or created for the User (Covered Entity). Strict limits are set so Office Ally is only able to use PHI (ePHI) to complete the agreed upon services for the User.
- Specific Uses and Disclosures that are permitted for Office Ally are listed in the BAA
Implement Safeguards to protect PHI (ePHI)
- Administrative
- Physical
- Technical
- Policies and Procedures determined by HIPAA
Reporting a Breach of PHI (ePHI) security
- Outlines the responsibilities of Office Ally (Business Associate) if there was any unauthorized discloser of PHI (ePHI)
- Required to inform the User (Covered Entity) of any breach of PHI (ePHI) within a reasonable timeframe, no more than 10 days from discovery, unless specifically indicated in BAA
- The notice needs to include what information was breached, and who it may have affected
- Office Ally (Business Associate) will assist in investigating and responding to the breach by providing the necessary information to the User (Covered Entity)
Availability of Information to Covered Entity
The BAA outlines the type of information and the timeframe in which, if requested, Office Ally (Business Associate) must provide to the User (Covered Entity). This could include, but not limited to:
- Request to amend PHI
- Accounting of PHI
- Availability of Books and Records
- Record Retention
What are the Obligations of the User (Covered Entity)?
The User (Covered Entity) is responsible for conforming to all HIPAA regulations in their own practice/office/facility, as well as in their dealings with Office Ally (Business Associate). Office Ally is a clearinghouse Covered Entity under HIPAA, providing Business Associate services. Outlined in the BAA, there are multiple notifications the User (Covered Entity) must give Office Ally (Business Associate) if any of the following circumstances apply:
- One of the HIPAA Privacy Rule regulations is the Notice of Privacy Practices for PHI. If there are any restrictions or changes to that notice that would hinder Office Ally’s (Business Associate) ability to perform its services, the User (Covered Entity) must notify Office Ally.
- If there are any changes in who is authorized to access PHI (ePHI) in the User’s (Covered Entity) organization or practice, Office Ally (Business Associate) must be notified if the change would, in any way, affect the services provided.
- The User (Covered Entity) must notify Office Ally (Business Associate) of any new restrictions or changes they have agreed to for the use or disclosure of PHI (ePHI) that would hinder the Business Associate’s ability to provide services.
The HIPAA Privacy and Security Rules establish new regulations to protect patients’ privacy, and improve the security surrounding that information. New obligations and responsibilities for Covered Entities and Business Associates help accomplish this. Office Ally strives continuously to ensure the utmost privacy and security for our users, in both the Covered Entity and Business Associate roles.
How can I obtain a copy of Office Ally’s Security Policies and Procedures?
Send an email to Office Ally’s Compliance Department, Compliance@OfficeAlly.com, with the following information:
- Office Ally Username
- Phone Number
- Security Policy requested (e.g., disaster recovery, SOC 2 report, backup policy)
- Reason For Request
Security Contacts / Incident Reporting
If you have questions about Office Ally’s Security and Privacy Policies, would like to report a suspected incident, non-compliance or unethical behaviors, contact Office Ally’s Compliance Department using one of the methods below:
- Office Ally, Inc.
Attn: Chere Jensen, Compliance Manager
P.O. Box 872020
Vancouver, WA 98687 - Email:
compliance@officeally.com - Compliance Hotline: 360-975-7004
Leave an anonymous or identified message on Office Ally’s Compliance Hotline.
Terms and Notices
Talk with a Trusted Ally
Sales Professionals
Need help finding a product or figuring out which product(s) to is right for you?
If so, please speak with one of our Sales Consultants. We're helpful, friendly, and provide easy-to-understand breakdowns of our products. Connect with us today.
Support Experts
Need help setting up a product or figuring out how to do something specific? Or is it a bit more complicated?
If so, please talk with one of our Support Experts.
We're your Ally, here to help support you and your team. Connect with us today for live support, & more.
