If a Degree Wellness franchisee (Business Associate) provides PHI to the Secretary, what else must they do?

According to Degree Wellness's 2025 Franchise Disclosure Document, if a Business Associate provides Protected Health Information (PHI) to the Secretary, they must also provide a copy of that PHI to the Covered Entity concurrently. This requirement ensures that the Covered Entity remains informed about what information has been shared with the Secretary and maintains oversight of the Business Associate's compliance with HIPAA regulations.

This obligation is part of a broader framework outlined in the Business Associate Agreement, which Degree Wellness franchisees must adhere to. The agreement also stipulates that the Business Associate must keep records, submit compliance reports, and make internal practices, books, and records available to the Secretary for compliance reviews. Furthermore, the Business Associate must cooperate with the Secretary during any investigation or compliance review of the Covered Entity and permit access to facilities, books, records, and accounts during normal business hours.

For a prospective Degree Wellness franchisee, this means that they must establish procedures to ensure that any PHI provided to the Secretary is simultaneously provided to the Covered Entity. This requires maintaining accurate records of all disclosures and having a system in place to quickly and efficiently share information. Failure to comply with these requirements could result in breaches of the Business Associate Agreement and potential penalties under HIPAA, the HIPAA Regulations, and the HITECH Act.

It is important to note that the agreement specifies that no attorney-client or other legal privilege is waived by virtue of these provisions. Additionally, all PHI is deemed owned by the Covered Entity unless otherwise agreed in writing, reinforcing the Covered Entity's control over the information and the Business Associate's responsibilities in handling it.