Is the Healthsource Chiropractic Business Associate authorized to use PHI to de-identify the PHI?
Healthsource_Chiropractic Franchise · 2025 FDDAnswer from 2025 FDD Document
Business Associate agrees that it is permitted to use or disclose PHI only as follows: (a) upon obtaining the authorization of the patient to whom such information pertains in accordance with 45 C.F.R. 164.502 (a)(1)(iv) and 164.508, (b) upon obtaining the consent of a patient to whom such information pertains, if the use or disclosure is for purposes of treatment, payment, or health care operations, (c) without an authorization or consent, if in accordance with 45 C.F.R. 164.506, 164.510, 164.512, 164.514(e), 164.514(f), 164.514(g), (d) Business Associate may use PHI for data aggregation services relating to the health care operations of Covered Entity, (e) Business Associate is authorized to use PHI to de-identify the PHI, (f) Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, (g) Business Associate may disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of the Business Associate, provided (1) the disclosures are required by law, or (2) Business Associate obtains reasonable assurances from the person or entity to whom the PHI is disclosed that the information will remain confidential and be used or further disclosed only as required by law or for the purposes for which it was disclosed the such person or entity, and the person notified Business Associate of any instances of which it is aware in which the confidentiality of the PHI has been breached, and (h) as otherwise permitted or required by agreement or law.
Source: Item 23 — Receipts (FDD pages 77–282)
What This Means (2025 FDD)
According to the 2025 Healthsource Chiropractic Franchise Disclosure Document, the Business Associate, which is HealthSource Chiropractic, LLC, is authorized to use Protected Health Information (PHI) to de-identify it. This authorization is explicitly stated within the HIPAA Business Associate Agreement.
This means that Healthsource Chiropractic has the right to remove identifying information from patient data. De-identifying PHI is a process where all personal identifiers are removed, so the data can be used for research, analytics, or other purposes without revealing the identity of the individuals involved. This is a common practice in healthcare to protect patient privacy while still allowing valuable use of data.
As a Healthsource Chiropractic franchisee, it's important to understand the scope and limitations of this authorization. While Healthsource Chiropractic, LLC can de-identify PHI, the franchisee must still comply with all HIPAA regulations regarding the use and disclosure of PHI within their own clinic. The franchisee must also ensure that any subcontractors or agents who handle PHI also comply with HIPAA regulations and have a business associate agreement in place.