Does Degree Wellness require its franchisees (Business Associates) to make their internal practices available to the Secretary for HIPAA compliance purposes?
Degree_Wellness Franchise · 2025 FDDAnswer from 2025 FDD Document
- (l) Secretary's Right to Audit.
Business Associate agrees to keep records, submit compliance reports, and make its internal practices, books, and records relating to the use and disclosure of PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, available to the Secretary for purposes of the Secretary determining Covered Entity's and/or Business Associate's compliance with HIPAA, the HIPAA Regulations and the HITECH Act.
Business Associate agrees to cooperate with the Secretary if the Secretary undertakes an investigation or compliance review of Covered Entity.
Business Associate shall permit the Secretary access to its facilities, books, records, accounts, and other sources of information, including PHI, during normal business hours.
No attorney-client, or other legal privilege will be deemed to have been waived by Business Associate by virtue of this provision of the Agreement.
Business Associate shall provide to Covered Entity a copy of any PHI that Business Associate provides to the Secretary concurrently with providing such PHI to the Secretary.
- (m) Data Ownership.
All PHI shall be deemed owned by Covered Entity unless otherwise agreed in writing.
Source: Item 23 — Receipts (FDD pages 66–257)
What This Means (2025 FDD)
According to Degree Wellness's 2025 Franchise Disclosure Document, franchisees operating as Business Associates must adhere to specific HIPAA compliance requirements. As part of the Business Associate Agreement, franchisees are obligated to maintain records, submit compliance reports, and make their internal practices, books, and records related to the use and disclosure of Protected Health Information (PHI) available to the Secretary. This requirement is for the purpose of the Secretary determining compliance with HIPAA, the HIPAA Regulations, and the HITECH Act.
This obligation extends to cooperating with the Secretary during investigations or compliance reviews of the Covered Entity, which in this case is Wellness Provider Therapies, P.A. Franchisees must permit the Secretary access to their facilities, books, records, accounts, and other sources of information, including PHI, during normal business hours. The agreement clarifies that no attorney-client or other legal privilege is waived due to this provision.
Furthermore, Degree Wellness franchisees must provide a copy of any PHI given to the Secretary concurrently to the Covered Entity. All PHI is deemed owned by the Covered Entity unless otherwise agreed in writing. This ensures that Degree Wellness franchisees, as Business Associates, are fully accountable for maintaining the privacy and security of patient health information and are subject to audits and reviews by regulatory bodies to verify compliance.