Under what circumstances can the Degree Wellness Business Associate disclose PHI?
Degree_Wellness Franchise · 2025 FDDAnswer from 2025 FDD Document
pect to PHI of Covered Entity, as outlined below.
3. Obligations and Activities of Business Associate*.*
- (a) Permitted Uses. Except as otherwise limited in this Agreement, Business Associate may use PHI (i) for the proper Administrative and administration of Business Associate, (ii) to carry out the legal responsibilities of Business Associate, or (iii) for Data Aggregation purposes for the Health Care Operations of Covered Entity. Business Associate shall not use PHI in any manner that would constitute a violation of the Privacy Rule or the HITECH Act if so used by Covered Entity. Business Associate agrees to limit its use of PHI to the minimum amount necessary to accomplish the intended purpose of the use.
- (b) Permitted Disclosures. Business Associate may disclose PHI (i) for the proper Administrative and administration of Business Associate, (ii) to carry out the legal responsibilities of Business Associate, (iii) as Required By Law, or (iv) for Data Aggregation purposes for the Health Care Operations of Covered Entity. Business Associate shall not disclose PHI in any manner that would constitute a violation of the Privacy Rule or the HITECH Act if so disclosed by Covered Entity. In addition, if Business Associate discloses PHI to a third party, Business Associate must obtain, prior to making any such disclosure, (i) satisfactory written assurances from such third party that the PHI will be held as confidential as provided pursuant to this Agreement and only disclosed as Required By Law or for the purposes for which it was disclosed to such third party, and (ii) a written agreement from such third party to immediately notify Business Associate of any breaches of confidentiality of the PHI, to the extent such third party has obtained knowledge of such breach.
Source: Item 23 — Receipts (FDD pages 66–257)
What This Means (2025 FDD)
According to Degree Wellness's 2025 Franchise Disclosure Document, the Business Associate Agreement outlines specific conditions under which a franchisee, acting as a Business Associate, can disclose Protected Health Information (PHI). Degree Wellness permits the disclosure of PHI for the proper administration of the Business Associate, to fulfill legal responsibilities, as required by law, or for data aggregation purposes related to the healthcare operations of the Covered Entity. However, Degree Wellness mandates that the Business Associate must not disclose PHI in any manner that would violate the Privacy Rule or the HITECH Act if the Covered Entity were to do so.
Degree Wellness requires that if the Business Associate discloses PHI to a third party, they must first obtain written assurances that the third party will maintain the confidentiality of the PHI as stipulated in the agreement. This includes ensuring that the PHI is disclosed only as required by law or for the specific purposes for which it was disclosed to the third party. Additionally, the third party must provide a written agreement to immediately notify the Business Associate of any breaches of confidentiality concerning the PHI if they become aware of such breaches.
Degree Wellness also emphasizes the importance of limiting the disclosure of PHI to the minimum amount necessary to achieve the intended purpose of the disclosure. Furthermore, the Business Associate is obligated to report any unauthorized access, use, or disclosure of PHI, as well as any security incidents, to the Covered Entity in writing. This notification must occur within twenty-four hours of the Business Associate becoming aware of the unauthorized activity or security incident. These detailed requirements ensure that Degree Wellness franchisees handle PHI responsibly and in compliance with all applicable laws and regulations.