Are accreditation organizations business associates of the covered entities they accredit?
Yes. The HIPAA Privacy Rule explicitly defines organizations that accredit covered entities
as business associates. See the definition of “business associate” at 45 CFR 160.103
Like other business associates, accreditation organizations provide a service to the covered entity which requires the sharing of protected health information. The business associate provisions may be satisfied by standard or model contract forms which could require little or no modification for each covered entity. As an alternative to the business associate contract, covered entities may disclose a limited data set of protected health information, not including direct identifiers, to an accreditation organization, subject to a data use agreement. See 45 CFR 164.514
If only a limited data set of protected health information is disclosed, the satisfactory assurances required of the business associate are satisfied by the data use agreement.
Date Created: 12/19/2002
Last Updated: 03/14/2006