We occasionally need to courier protected health information (PHI) such as original x-rays to another location. Do we need a business associate agreement with each courier service?
The rule does not require a business associate agreement with a person or organization that acts merely as a conduit of information, such as the U.S. Postal Service, certain private couriers and their electronic equivalents. Since no disclosure is intended and the probability is small for incidental release, no agreement is necessary.
