This document outlines whether a business associate agreement is required when protected health information is involved. It first asks if the services involve protected health information. If yes, it then determines if the person is a healthcare provider seeking information for treatment, a member of the provider's workforce, or only a conduit of incidental information. If the answers are yes, no agreement is required. Otherwise, it asks if the person is performing services on behalf of the provider or if the information is restricted to a limited data set for research - if yes, no agreement is needed. In all other cases, a business associate agreement is required.

1. Do the services involve the use or
disclosure of “protected health No
information”?
Yes
Is the person a health care provider
seeking information for treatment Yes
purposes?
No
Is the person a member of the health
Yes
care providers "workforce"?
No
Business
Is the person/entity only a conduit of Associate
information or is access to "protected Yes Agreement
health information" incidental? IS NOT
required
No
Is the person/entity performing services No
on behalf of the provider?
Yes
Is the information involved restricted to Yes
a "limited data set"?
No
Is the disclosure preparatory to
research or under an IRB approved Yes
waiver for research?
No
Business
Associate
Agreement
IS
required
{LEC972190.DOCX;188888.000001 }

2. {LEC972190.DOCX;188888.000001 }