The Department of Health (DOH) works to protect and improve the
health of people in Washington state. The department performs many
functions and provides services to fulfill this mission. Although
the services, functions and activities of the Department of Health
benefit other organizations, the department’s work is performed
primarily to support the agency’s mission and not for or on behalf
of other organizations.
Following this reasoning, the department has concluded that, as a
general rule, it is not a Business Associate of other organizations.
This reasoning agrees with the recent guidance provided by US
Department of Health and Human Services. The
April 11, 2003 MMWR
titled, "HIPAA Privacy Rule and Public Health" page 8
paragraph 3; states:
"Public health authorities receiving
information from covered entities as required or authorized by
law are not business associates of the covered entities and
therefore are not required to enter into business associate
agreements. Public health authorities that are not covered
entities also are not required to enter into business associate
agreements with their public health partners and contractors."
DOH and Local Health Jurisdictions (LHJ's) work together to provide services
to the community. In many cases, the LHJ provides individually identifiable
health information to DOH. DOH uses this information for many purposes
beneficial to both organizations. DOH views this use of information
as essential to fulfilling its mission and therefore not primarily "for
or on behalf" of the LHJ. This cooperative and interdependent relationship
does not make DOH a business associate of LHJ.
DOH sometimes helps in the support of computer systems
jointly used by the DOH and other organizations. Even though there may
be benefits to the other organization, DOH is performing functions to
fulfill its own mission and not acting "for or in behalf"
of the grantees and contractors. DOH is not their business associate.
Several programs within DOH facilitate state and federal grants
or contracts by providing funding to public and private organizations
which provide healthcare services. These organizations may or may not
be HIPAA covered entities. The grant or contract requires that they
provide the department with individually identifiable health information
in order to substantiate the grant activities and funding. These grant
activities and interactions support of the DOH mission and not "for
or in behalf" of the other organization. DOH is not a business
associate of the other organization.
