Who is responsible for determining the scope of PHI for individual access requests related to Degree Wellness?

According to Degree Wellness's 2025 Franchise Disclosure Document, the Covered Entity is solely responsible for determining the scope of Protected Health Information (PHI) related to individual access requests. This means that Degree Wellness, as the Covered Entity, retains control over what PHI is disclosed when an individual requests access to their health information. The Business Associate (the franchisee) must cooperate with Degree Wellness to fulfill these requests and comply with relevant regulations like 45 C.F.R. § 164.524 and applicable state laws. If a franchisee receives a request for PHI, they must immediately forward it to Degree Wellness.

This division of responsibility is important for maintaining compliance with HIPAA and other privacy regulations. It ensures that Degree Wellness maintains consistent control over PHI disclosures across all franchise locations. The franchisee's role is to assist in providing access to the information as directed by Degree Wellness, rather than making independent decisions about what to disclose.

Furthermore, if there are costs associated with reproducing and delivering PHI, and the franchisee contributes to this process, Degree Wellness will compensate the franchisee for their portion of the work. This clarifies the financial responsibilities associated with fulfilling PHI access requests. Degree Wellness also ensures that franchisees, as Business Associates, make any necessary amendments to PHI at Degree Wellness's request, reinforcing the franchisor's oversight in maintaining accurate health records.