12. Business associate

340:2-8-12. Business associate

Revised 9-16-19

(a) A business associate, per Section 160.103 of Title 45 of the Code of Federal Regulations (45 C.F.R. § 160.103), is defined as an individual or entity who:

(1) performs on behalf of the Oklahoma Department of Human Services (DHS), any function or activity involving the use or disclosure of protected health information (PHI); and

(2) is not a member of the DHS workforce.

(b) The definition of "function or activity" includes:

(1) claims processing or administration;

(2) data analysis and data processing;

(3) utilization review;

(4) quality assurance; and

(5) billing, actuarial accounting, and other financial services.

(c) DHS discloses a client's PHI to a business associate, and allows a business associate to create or receive PHI on behalf of DHS.

(d) DHS enters into a contractual agreement with a business associate, per 45 C.F.R.

§ 164.504(e)

. The contract includes the appropriate language and provisions required by the federal Health Insurance Portability and Accountability ActPrivacy Rule regarding the proper use and disclosure of

PHI. • 1

INSTRUCTIONS TO STAFF 340:2-8-12

Revised 9-16-19

1.Questions regarding the status of a vendor or independent contract are forwarded to the privacy officer, per Oklahoma Administrative Code 340:2-8-5.

Library: Policy

INSTRUCTIONS TO STAFF 340:2-8-12