What is the Degree Wellness Business Associate's obligation regarding individual requests for access to PHI?
Degree_Wellness Franchise · 2025 FDDAnswer from 2025 FDD Document
tion 3(e) above with respect to ePHI. If Business Associate knows of a pattern of activity or practice of an agent that constitutes a violation of the agent's obligations to Business Associate, Business Associate shall take reasonable steps to end the violation, and if such steps are unsuccessful, Business Associate must terminate the arrangement if feasible.
- (i) Mitigation of Unauthorized Uses or Disclosures. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate or one of its agents or subcontractors in violation of the requirements of this Agreement.
- (j) Authorized Access to PHI.
- (1) Individual Requests for Access. Business Associate shall cooperate with Covered Entity to fulfill all requests by Individuals for access to the Individual's PHI. Business Associate shall cooperate with Covered Entity in all respects necessary for Covered Entity to comply with 45 C.F.R. § 164.524 and applicable State law. If Business Associate receives a request from an Individual for access to PHI, Business Associate shall immediately forward such request to Covered Entity.
- (2) Scope of Disclosure. Covered Entity shall be solely responsible for determining the scope of PHI and/or Designated Record Set with respect to each request by an Individual for access to PHI. In the event that Covered Entity decides to charge a reasonable cost-based fee for the reproduction and delivery of PHI to an Individual, Covered Entity shall deliver a portion of this fee to Business Associate in the event any such reproduction or delivery is made by Business Associate, and in proportion to the amount of work done by Business Associate in producing and delivering the PHI.
- (3) Designated Record Set.
Source: Item 23 — Receipts (FDD pages 66–257)
What This Means (2025 FDD)
According to Degree Wellness's 2025 Franchise Disclosure Document, as a Business Associate, the franchisee must cooperate with the Covered Entity (Wellness Provider Therapies, P.A.) to fulfill all requests from individuals to access their Protected Health Information (PHI). This cooperation extends to ensuring compliance with 45 C.F.R. § 164.524 and any applicable state laws. If the Business Associate receives a direct request for PHI from an individual, they are obligated to immediately forward that request to the Covered Entity.
Degree Wellness franchisees must understand that the Covered Entity retains sole responsibility for determining the scope of PHI to be disclosed for each individual request. However, if the franchisee maintains PHI in a Designated Record Set, they must provide access to this information to either the Covered Entity or directly to the individual, as directed by the Covered Entity, to meet the requirements of 45 C.F.R. § 164.524 and state law. If the Designated Record Set is maintained electronically, the franchisee must provide the information in electronic format.
Furthermore, Degree Wellness franchisees are obligated to make any amendments to PHI within a Designated Record Set at the request of the Covered Entity, in accordance with 45 C.F.R. § 164.526. Following any such amendment, the franchisee must provide written notice to the Covered Entity within fifteen business days, confirming that the changes have been made and including any information necessary for the Covered Entity to adequately notify the individual. These requirements ensure that individuals have proper access to and control over their health information, and that Degree Wellness franchisees, as Business Associates, are compliant with HIPAA regulations.