Likely Effects of Provisions Regarding Business Partners Under the Proposed Federal Privacy Rule

On November 3, 1999, President Clinton signed the Proposed Standards for Privacy of Individually Identifiable Health Information (the "Privacy Rule")⁽¹⁾. The Privacy Rule seeks to protect the privacy of individually identifiable health information, or "protected health information" ("PHI")⁽²⁾. This issue of the Healthcare Law Advisor focuses on the Privacy Rule’s likely impact on Business Partners through its regulation of Covered Entities. Although the rule is not yet final, we are issuing this Advisor because the far-reaching consequences of the finalized Privacy Covered Entities and Business Partners necessitate planning as soon as possible.

1. Disclosure of PHI by a Covered Entity to a Business Partner and Contract Requirements.

   Covered Entities are permitted to disclose PHI to other Covered Entities for consultation or referral for treatment purposes however, such provider is prohibited from further use or disclosure of such PHI. For purposes other than consultation or referral for treatment, Covered Entities must receive "satisfactory assurance" from the Business Partner before disclosing PHI to the Business Partner or otherwise allowing the Business Partner to use such PHI. (See Privacy Rule 45 CFR § 164.506(e)(1).)

   "Satisfactory assurance" consists of a contract between the Covered Entity and the Business Partner, which contract contains specific language regarding PHI. (See Privacy Rule 45 CFR § 164.506(e)(2).) Consequently, before a Covered Entity discloses PHI to a person or an entity for purposes other than referral or consultation for treatment purposes, there must be a contract in place which contains the following provisions:

   1. A prohibition against the use or disclosure by the Business Partner of PHI provided by the Covered Entity, other than as stated in the contract;
   2. A clause prohibiting the use or disclosure of PHI by the Business Partner in violation of the Privacy Rule;
   3. A provision requiring the Business Partner to create and implement appropriate safeguards to prevent use or disclosure of the PHI other than as provided for in the contract;
   4. Language requiring the Business Partner to report any use or disclosure not provided for in the contract to the Covered Entity;
   5. A stipulation that the Business Partner ensure that its subcontractors and agents to whom the Business Partner discloses PHI abide by the restrictions contained both in the Privacy Rule and in the contract between the Covered Entity and such Business Partner;
   6. A term establishing the manner in which the Business Partner will make PHI accessible to individuals who are the subjects of such PHI when the Business Partner is the only person or entity possessing such PHI; (according to the preamble of the proposed Privacy Rule, the contract must also contain terms stating how the Business Partner will apprise the Covered Entity of any alteration of information, and the method via which the Covered Entity can access such information)
   7. A specification the Business Partner will make available to the Secretary of the Department of Health and Human Services the Business Partner’s internal practices, books, and records relating to the use and/or disclosure of PHI;
   8. A requirement that the Business Partner return or destroy all PHI upon termination of the contract and retain no copies of such PHI;
   9. A condition that the Business Partner incorporate any changes to PHI when notified by the Covered Entity to do so;
   10. A provision that individuals who are the subjects of PHI disclosed to the Business Partner pursuant to the contract are intended third-party beneficiaries; and
   11. A condition that, if the Business Partner violates any of the terms of the contract, the Covered Entity may terminate the contract.

   (Privacy Rule 45 CFR § 164.506(e))

2. Compliance with Covered Entity’s Notice of Policies Regarding Use and Disclosure.

Every Covered Entity is required to promulgate and distribute to its enrollees a notice of its policies regarding use and disclosure of PHI (the "Notice") pursuant to the Privacy Rule. (See Privacy Rule 45 CFR § 164.512.) In addition to complying with the terms of the contract between the Covered Entity and its Business Partner, including the requirements of the Privacy Rule regarding use and disclosure of PHI, and applicable state law⁽⁵⁾, a Business Partner must comply with the terms of the Covered Entity’s Notice as distributed to individuals who are the subject of such PHI. (See 64 Fed. Reg. 59948, preamble Section II.C.5(b)(i).) For example, if a Covered Entity’s policy, as described in its Notice, prohibits all disclosures for research purposes, the Business Partner will be similarly restricted from using or disclosing any PHI for research purposes

3. Covered Entity’s Liability and Duty to Mitigate Harm.

• Duty to Monitor. According to the preamble to the proposed Privacy Rule, Sections II.H.5-II.H.6, a Covered Entity is not required to actively monitor the activities of its Business Partners. (See 64 Fed. Reg. 59991.) However, for any Business Partner which seriously or repeatedly violates the restrictions contained in the contract between the Covered Entity and the Business Partner, the Covered Entity is required to monitor the Business Partner’s continuing performance under the contract. (See 64 Fed. Reg. 59991.) Consequently, according to the preamble of the proposed Privacy Rule, until or unless the Business Partner seriously and/or repeatedly violates the contract, the Covered Entity has no duty to monitor its Business Partners.

• Sanctions, Contract and Duty to Terminate. Additionally, the Secretary of the Department of Health and Human Services encourages Covered Entities to establish relationships with their Business Partners such that a Covered Entity sanctions its Business Partners for any impermissible use and/or disclosure of PHI. (See 64 Fed. Reg. 59991.) Language permitting the Covered Entity to monitor and sanction the Business Partner should therefore be included in the contract between them. The preamble reiterates that a Covered Entity is required to terminate its contract with any Business Partner if it becomes clear to the Covered Entity that the Business Partner cannot or will not maintain the privacy of PHI. (See 64 Fed. Reg. 59991.)