HITECH Business Associate Rule Tool Section 9: Limitations on Business Associate Remuneration for Services

• PLEASE SEE SECTION 1 FOR INFORMATION ABOUT USING THIS TOOL

The healthcare sector is subject to a number of complex, overlapping and often confusing laws and regulations controlling the terms and conditions under which healthcare organizations can pay or be paid fees or receive benefits or other incentives, generally called “remuneration” for these purposes. Some of these requirements and prohibitions are counterintuitive or contrary to accepted, fully legal practices in other sectors, and some of them – the federal “Stark” and “antikickback” laws in particular – impose severe civil and criminal penalties for their violations. Anyone not familiar with these laws  – perhaps Business Associates new to their role in healthcare in particular – should be sure their financial arrangements and incentive structures are compliant with these requirements.

HITECH and the Omnibus Rule have added yet another layer of complexity and risk. HITECH prohibits the “sale” of PHI. The Omnibus Rule then interpreted “sale of PHI” to mean:

A disclosure of PHI by a Covered Entity or Business Associate, where the Covered Entity or Business Associate directly or indirectly receives remuneration from or on behalf of the recipient of the PHI in exchange for the PHI.

“Sale of PHI” does not include disclosures of PHI which entail:

• Remuneration for legitimate public health purposes.
• Remuneration for research purposes, as defined under the Privacy Rule, limited to “a reasonable cost-based fee to cover the cost to prepare and transmit the PHI.”
• Remuneration for treatment and payment purposes, as defined under the Privacy Rule.
• Remuneration for the sale, transfer, merger, or consolidation of all or part of the Covered Entity and for related due diligence, as part of health care operations.
• Remuneration to or by a Business Associate for activities that the Business Associate undertakes on behalf of an upstream Covered Entity or Business Associate, where the only remuneration provided is by the upstream entity to the Business Associate for the performance of such activities.
• Reasonable remuneration by an individual for PHI access or copying.
• Remuneration when the disclosure is required by law as permitted under the Privacy Rule.
• Remuneration for any other purpose permitted by and in accordance with the Privacy Rule, limited to a “reasonable, cost-based fee to cover the cost to prepare and transmit the PHI for such purpose” or a fee “otherwise expressly permitted by other law.”

For most Business Associate purposes one or more of these exceptions should apply, probably most often the exception for “activities that the Business Associate undertakes” on behalf of the upstream entity.

It should be noted, however, that the only exception which seems to apply to agreements or arrangements between a Business Associate and a non-Business Associate contractor, for purposes of the Business Associate’s “proper management administration” is the exception for “purposes permitted by the Privacy Rule.” In that case, to the extent remuneration is provided to the Business Associate for PHI disclosed to the contractor, it will have to be reasonable, and based on the cost of preparing and transmitting the PHI for the purpose.

This should not ordinarily be an issue, unless the contractor is (for example) providing the Business Associate with a discount for rules-based care coordination support services because the Business Associate is providing the contractor with PHI so the contractor can develop or refine such rules for its own benefit. That would be a prohibited “sale of PHI.”

This kind of analysis suggests that in any arrangement where a contractor provides something like a volume-based incentive for transactions or records involving PHI, the parties should document that the incentive is not based on the PHI but on other factors, such as volume-based efficiencies.

• GO TO NEXT SECTION
• GO TO SECTION 2:  TABLE OF LINKS

© 2013 John R. Christiansen