Regarding PHI, what is Dermani Medspa's Business Associate prohibited from doing?
Dermani_Medspa Franchise · 2025 FDDAnswer from 2025 FDD Document
II. Obligations and Activities of Business Associate
- a. Use and Disclosure. Business Associate will not use or further disclose PHI other than as permitted or required by this Agreement or as Required by Law. Business Associate will not use or disclose PHI in a manner that would violate the Regulations if done by Covered Entity.
Source: Item 23 — RECEIPTS (FDD pages 66–311)
What This Means (2025 FDD)
According to Dermani Medspa's 2025 Franchise Disclosure Document, a Business Associate is restricted in how they handle Protected Health Information (PHI). Specifically, the Business Associate cannot use or disclose PHI in any way not permitted or required by the Business Associate Agreement or by law. Furthermore, the Business Associate must not use or disclose PHI in a manner that would violate privacy regulations if Dermani Medspa itself (the Covered Entity) were to do it. This means the Business Associate is held to the same standards as Dermani Medspa regarding patient privacy.
This restriction ensures that patient information remains confidential and secure. The Business Associate must comply with the HIPAA Security Rule, implementing safeguards to prevent unauthorized use or disclosure of electronic PHI (EPHI). They must also adhere to all applicable requirements of the HIPAA Privacy Rule. This includes having written agreements with any subcontractors who handle PHI, ensuring those subcontractors also adhere to the same restrictions.
If the Business Associate violates these rules by improperly using or disclosing PHI, they are obligated to mitigate any harmful effects to the extent practicable. They must also report any unauthorized use or disclosure of PHI, as well as any security incidents involving EPHI, to Dermani Medspa. These measures are in place to protect patient privacy and maintain compliance with federal regulations.