For Healthsource Chiropractic, what is the Business Associate required to do regarding agents, employees, subsidiaries, subcontractors, vendors, and affiliates to whom it provides PHI?
Healthsource_Chiropractic Franchise · 2025 FDDAnswer from 2025 FDD Document
Further, Business Associate agrees that to the extent it has access to PHI, Business Associate will fully comply with the requirements of HIPAA and this Agreement with respect to such PHI; and, further, that every agent, employee, subsidiary, subcontractor, vendor and affiliate of Business Associate to who it provides PHI received from, or created or received by Business Associate on behalf of, Covered Entity, will be required to fully comply with HIPAA, and will be bound by written agreement to the same restrictions and terms and conditions as set forth in the Agreement.
Source: Item 23 — Receipts (FDD pages 77–282)
What This Means (2025 FDD)
According to Healthsource Chiropractic's 2025 Franchise Disclosure Document, as a Business Associate under HIPAA, Healthsource Chiropractic must ensure that every agent, employee, subsidiary, subcontractor, vendor, and affiliate to whom it provides Protected Health Information (PHI) received from, or created or received on behalf of, the Covered Entity (the franchisee) fully complies with HIPAA. These parties must also be bound by a written agreement that includes the same restrictions, terms, and conditions as set forth in the HIPAA Business Associate Agreement. This requirement ensures that all parties handling PHI adhere to HIPAA regulations, maintaining the privacy and security of patient information.
This requirement means that Healthsource Chiropractic needs to have formal agreements in place with all its related parties who have access to PHI. These agreements must mirror the obligations Healthsource Chiropractic has to the franchisee under the Business Associate Agreement. This creates a chain of responsibility, ensuring that PHI is protected at every level of the organization and its network of service providers.
For a prospective Healthsource Chiropractic franchisee, this highlights the importance of understanding HIPAA compliance and the responsibilities associated with handling PHI. While Healthsource Chiropractic takes on the role of Business Associate and has primary responsibility for HIPAA compliance, the franchisee (Covered Entity) must also ensure that Healthsource Chiropractic is meeting its obligations. The franchisee should carefully review the Business Associate Agreement and understand the flow of PHI to ensure that all involved parties are compliant. This also means understanding the implications and potential liabilities associated with breaches of PHI, as these can result in significant penalties under HIPAA.