Are employers working with a Supported Employment program considered business associates?
First, the Supported Employment program must determine whether or not it is a “covered entity” under HIPAA. If so, the second question to be considered is whether or not patient authorization is required to disclose protected health information (PHI) to the employers. It is probably reasonable to assume that it is, if the disclosures cannot be fairly characterized as being made for treatment, payment, or health care operations purposes. If patient authorization is indeed needed, the Supported Employment program has three options to consider: (1) simply obtain patient authorization to make these disclosures; (2) include the employers as members of its workforce and require that they participate in the Supported Employment’s HIPAA training program; or (3) execute a Business Associate Agreement, if the employers can be fairly characterized as providing a service for or on behalf of the Supported Employment program for which access to PHI is necessary. It may be that the most practical sol
