What should a Degree Wellness Business Associate do if they receive a request from an individual for access to PHI?

According to Degree Wellness's 2025 Franchise Disclosure Document, a Degree Wellness Business Associate must immediately forward any requests from an individual seeking access to their Protected Health Information (PHI) to the Covered Entity. The Covered Entity, identified as WELLNESS PROVIDER THERAPIES, P.A., is then solely responsible for determining the scope of PHI and/or Designated Record Set relevant to the request. This ensures that all decisions regarding access to PHI are managed by the appropriate entity.

This requirement is part of Degree Wellness's compliance with HIPAA (Health Insurance Portability and Accountability Act) and HITECH (Health Information Technology for Economic and Clinical Health Act) regulations, which mandate specific protections for the privacy and security of PHI. By forwarding the request promptly, the Business Associate helps ensure that the Covered Entity can comply with the regulatory timelines and requirements for providing access to PHI under 45 C.F.R. § 164.524 and applicable State law.

This process also clarifies the division of responsibilities between the Business Associate and the Covered Entity. The Business Associate's role is to provide the necessary cooperation and support to facilitate access, while the Covered Entity retains control over the decision-making process regarding what information is disclosed. This distinction is important for maintaining compliance and minimizing the risk of unauthorized disclosures of PHI. Prospective franchisees should understand this process and ensure they have systems in place to promptly forward any such requests to the Covered Entity.