What must a Dermani Medspa Business Associate make available to the Covered Entity or the Secretary?

According to Dermani Medspa's 2025 Franchise Disclosure Document, a Business Associate must make its internal practices, books, and records relating to the use and disclosure of Protected Health Information (PHI) available to the Covered Entity (Dermani Medspa) or to the Secretary (of Health and Human Services). This is for the purpose of determining Dermani Medspa's compliance with the Regulations, which likely refers to HIPAA and related healthcare regulations.

Furthermore, the Business Associate is required to notify Dermani Medspa regarding any PHI that the Business Associate provides to the Secretary. This notification must occur concurrently with providing the PHI to the Secretary. Additionally, upon request from Dermani Medspa, the Business Associate must provide Dermani Medspa with a duplicate copy of such PHI.

In practical terms, this means that if a Dermani Medspa franchisee (as a Business Associate) is audited or investigated, they must cooperate fully with both Dermani Medspa and regulatory authorities. They must also keep Dermani Medspa informed of any disclosures of PHI made to the Secretary and provide copies of the disclosed information if requested. This ensures that Dermani Medspa can maintain oversight and verify compliance with privacy regulations across all its franchise locations.