When a medical practice moves from a fax machine to an online fax service, someone usually asks whether the practice needs a business associate agreement with the provider. It is the right question, and it is easier to answer once you know what HIPAA means by a business associate and what the agreement itself has to say.
This article explains both, then lists the questions worth putting to any fax provider before patient documents move. It is general information, not legal advice. The decision about whether a particular arrangement needs an agreement, and whether a given agreement is adequate, belongs to your privacy officer or counsel.
When a fax service is a business associate
HIPAA's definitions are in 45 CFR 160.103. In broad terms, a business associate is a person or organization that creates, receives, maintains or transmits protected health information on behalf of a covered entity. The definition names data transmission services specifically: it includes a person that provides data transmission services with respect to protected health information to a covered entity and that requires access on a routine basis to that information.
An online fax service that receives faxes on your number, converts them into documents, stores them and delivers them to your staff is handling patient information on your behalf in exactly that sense. That is why most practices treat their fax provider as a business associate. A traditional phone line that only carries the signal between two fax machines, with nothing stored in between, is a different arrangement, and it is one reason the question did not come up when the office had a fax machine.
The definition also reaches further down the chain. A subcontractor that creates, receives, maintains or transmits protected health information on behalf of a business associate is itself a business associate. If your fax provider relies on another company to host or deliver documents, that relationship matters too.
What the agreement must contain
The required content of a business associate contract is set out in 45 CFR 164.504(e). Reading the regulation itself is the best way to evaluate a contract you are handed, because it tells you what to look for rather than what a vendor chooses to emphasize. Among other things, the contract must:
- establish the permitted and required uses and disclosures of protected health information by the business associate;
- provide that the business associate will not use or further disclose the information other than as the contract permits or the law requires;
- require appropriate safeguards, and compliance with the Security Rule for electronic protected health information;
- require the business associate to report any use or disclosure not provided for by the contract, including breaches of unsecured protected health information;
- require that any subcontractors that create, receive, maintain or transmit the information on the business associate's behalf agree to the same restrictions;
- make protected health information available so the practice can meet patients' access requests;
- make the business associate's practices, books and records available to the Secretary of Health and Human Services for determining compliance; and
- at termination, require the business associate to return or destroy all protected health information it still holds, where feasible.
The Security Rule makes the same point from the other direction. Under its administrative safeguards, a covered entity may permit a business associate to handle electronic protected health information on its behalf only if it obtains satisfactory assurances that the information will be appropriately safeguarded. The business associate agreement is how those assurances are documented.
Questions to ask a fax provider
Whether or not a provider's standard terms already address these points, asking them directly shortens the review and surfaces the answers you would otherwise discover during an incident.
About the agreement
- Will you sign a business associate agreement, and is it your template or ours?
- Which services and accounts does the agreement cover? Fax, storage, email delivery and support access can sit under different terms.
- How and how quickly will you report a security incident or a breach to us?
About subcontractors
- Which other companies host, transmit or store our faxes on your behalf?
- Do those companies have agreements with you that carry the same restrictions?
About the documents themselves
- Where are faxes stored, for how long by default, and can we change that period?
- Who on your staff can open a stored fax, and under what circumstances?
- What record exists of each transmission, and can we query it ourselves?
- When the contract ends, how are our documents returned or destroyed, and what confirmation do we receive?
The last question connects to your own records schedule. Our article on retaining and disposing of faxed patient records explains why the provider's deletion and your retention obligations need to agree.
Common misunderstandings
"A business associate agreement makes the service compliant"
It does not. An agreement allocates responsibilities and documents assurances. Your practice still has its own obligations under the Privacy and Security Rules, including deciding who on your staff can see which faxes. Our guide to electronic fax and HIPAA compliance covers those obligations in more detail.
"If the provider is secure, we do not need an agreement"
Strong security is necessary, but the regulation asks for documented assurances, not only good practice. Security features are what you evaluate. The agreement is what records the commitment.
"The agreement only matters if something goes wrong"
The reporting, subcontractor and termination terms matter most during an incident, but the permitted use terms matter every day. They define what the provider may do with your patients' information when nothing has gone wrong at all.
Where LABUSA eFaaS fits
LABUSA eFaaS provides encrypted transmission and storage, named accounts and access control, a queryable record of every transmission, and retention you configure to match your own schedule. Where your documents fall under HIPAA, the obligation to meet it stays with your practice, and the decision about which agreements your arrangement requires is yours to make with your advisers. If your practice requires a business associate agreement, raise it during your workflow consultation so it can be reviewed before any patient information is exchanged.
To compare providers on the other questions that matter to a medical office, use our cloud fax provider checklist for medical practices. You can also read how eFaaS works, visit our medical practices page, start a 30-day free trial, or contact our team.