What is the Healthsource Chiropractic Business Associate's obligation regarding the use or disclosure of PHI incidental to the performance of services?

According to Healthsource Chiropractic's 2025 Franchise Disclosure Document, the Business Associate, HealthSource Chiropractic, LLC, may only use or disclose Protected Health Information (PHI) if it is incidental to performing services required under the Franchise Agreement with the Covered Entity, which is the franchisee. This means that any use or sharing of patient health information must directly relate to the services Healthsource Chiropractic provides to support the franchisee's operations.

Healthsource Chiropractic can use or disclose PHI if they obtain authorization from the patient, or consent if it is for treatment, payment, or healthcare operations. They can also do so without authorization or consent under specific regulations (45 C.F.R. 164.506, 164.510, 164.512, 164.514(e), 164.514(f), 164.514(g)). Healthsource Chiropractic is allowed to use PHI for data aggregation related to the healthcare operations of the franchisee, to de-identify the PHI, or for their own management, administration, or legal responsibilities.

If Healthsource Chiropractic discloses PHI for their own management, administration, or legal duties, the disclosures must either be legally required, or they must get assurances from the recipient that the information will remain confidential and only be used as legally required or for the purpose it was disclosed. The recipient must also notify Healthsource Chiropractic of any confidentiality breaches. Subcontractors who handle PHI on behalf of Healthsource Chiropractic must agree to the same restrictions and conditions. Healthsource Chiropractic must also enter into a business associate agreement that complies with HIPAA with any and all subcontractors in order to disclose PHI to such subcontractor.