What is the Healthsource Chiropractic Business Associate authorized to do with PHI regarding de-identification?
Healthsource_Chiropractic Franchise · 2025 FDDAnswer from 2025 FDD Document
Business Associate agrees that it is permitted to use or disclose PHI only as follows: (a) upon obtaining the authorization of the patient to whom such information pertains in accordance with 45 C.F.R. 164.502 (a)(1)(iv) and 164.508, (b) upon obtaining the consent of a patient to whom such information pertains, if the use or disclosure is for purposes of treatment, payment, or health care operations, (c) without an authorization or consent, if in accordance with 45 C.F.R. 164.506, 164.510, 164.512, 164.514(e), 164.514(f), 164.514(g), (d) Business Associate may use PHI for data aggregation services relating to the health care operations of Covered Entity, (e) Business Associate is authorized to use PHI to de-identify the PHI, (f) Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, (g) Business Associate may disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of the Business Associate, provided (1) the disclosures are required by law, or (2) Business Associate obtains reasonable assurances from the person or entity to whom the PHI is disclosed that the information will remain confidential and be used or further disclosed only as required by law or for the purposes for which it was disclosed the such person or entity, and the person notified Business Associate of any instances of which it is aware in which the confidentiality of the PHI has been breached, and (h) as otherwise permitted or required by agreement or law.
Source: Item 23 — Receipts (FDD pages 77–282)
What This Means (2025 FDD)
According to the 2025 Healthsource Chiropractic Franchise Disclosure Document, the Business Associate is authorized to use Protected Health Information (PHI) to de-identify it. This authorization is outlined within the context of the HIPAA Business Associate Agreement included in the FDD.
In practical terms, this means that Healthsource Chiropractic, LLC, acting as the Business Associate, has the right to remove identifying information from patient data. De-identification is a process used to protect patient privacy while still allowing the data to be used for purposes such as research, data aggregation, or other analyses. By de-identifying PHI, Healthsource Chiropractic can utilize the data without violating HIPAA regulations or compromising patient confidentiality.
This authorization is subject to other provisions within the agreement that govern the use and disclosure of PHI. The Business Associate must still comply with all other applicable HIPAA regulations and the terms of the agreement, ensuring that the de-identification process meets the required standards for privacy and security. This includes ensuring subcontractors also agree to the same restrictions and conditions.