What is the Healthsource Chiropractic Business Associate's obligation regarding the use or disclosure of PHI without authorization or consent according to 45 C.F.R. 164.506, 164.510, 164.512, 164.514(e), 164.514(f), 164.514(g)?
Healthsource_Chiropractic Franchise · 2025 FDDAnswer from 2025 FDD Document
sclose PHI to a health plan for payment or health care operations purposes if the patient has requested this special restriction and has paid out of pocket in full for the health care item or service to which the PHI solely relates. Business Associate shall not directly or indirectly receive payment or other consideration in exchange for PHI, except as permitted under HIPAA; however, this prohibition shall not affect payment from Covered Entity to Business Associate for services provided by Business Associate.
-
- Required or Permitted Uses: Business Associate shall not and Covered Entity shall not request Business Associate to - use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity, except for any specific uses or disclosures set forth below. Business Associate may only use or disclose PHI incidental to the performance of its services required under the Franchise Agreement with Covered Entity. Business Associate agrees that it is permitted to use or disclose PHI only as follows: (a) upon obtaining the authorization of the patient to whom such information pertains in accordance with 45 C.F.R. 164.502 (a)(1)(iv) and 164.508, (b) upon obtaining the consent of a patient to whom such information pertains, if the use or disclosure is for purposes of treatment, payment, or health care operations, (c) without an authorization or consent, if in accordance with 45 C.F.R. 164.506, 164.510, 164.512, 164.514(e), 164.514(f), 164.514(g), (d) Business Associate may use PHI for data aggregation services relating to the health care operations of Covered Entity, (e) Business Associate is authorized to use PHI to de-identify the PHI, (f) Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, (g) Business Associate may disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of the Business Associate, provided (1) the disclosures are required by law, or (2) Business Associate obtains reasonable assurances from the person or entity to whom the PHI is disclosed that the information will remain confidential and be used or further disclosed only as required by law or for the purposes for which it was disclosed the such person or entity, and the person notified Business Associate of any instances of which it is aware in which the confidentiality of the PHI has been breached, and (h) as otherwise permitted or required by agreement or law.
-
- Subcontractors.
Source: Item 23 — Receipts (FDD pages 77–282)
What This Means (2025 FDD)
According to Healthsource Chiropractic's 2025 Franchise Disclosure Document, the Business Associate may disclose Protected Health Information (PHI) without authorization or consent if it is in accordance with 45 C.F.R. 164.506, 164.510, 164.512, 164.514(e), 164.514(f), 164.514(g). The Business Associate may use or disclose PHI incidental to performing services required under the Franchise Agreement with the Covered Entity. The Business Associate must comply with HIPAA, and any agent, employee, subsidiary, subcontractor, vendor, and affiliate who is provided PHI must also comply with HIPAA and be bound by written agreement to the same restrictions and terms as set forth in the agreement. The Business Associate must also comply with the Security and Privacy provisions of HIPAA with respect to electronic PHI to prevent misuse or disclosure of PHI other than as provided by the agreement.
Healthsource Chiropractic's Business Associate agrees that it is permitted to use or disclose PHI upon obtaining authorization of the patient according to 45 C.F.R. 164.502 (a)(1)(iv) and 164.508, or upon obtaining the consent of a patient if the use or disclosure is for purposes of treatment, payment, or health care operations. The Business Associate may use PHI for data aggregation services relating to the health care operations of Covered Entity, and is authorized to use PHI to de-identify the PHI. The Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, and may disclose PHI for these reasons if the disclosures are required by law, or if the Business Associate obtains reasonable assurances that the information will remain confidential and used only as required by law.
This agreement requires Healthsource Chiropractic franchisees to understand their obligations regarding the handling of Protected Health Information under HIPAA. Franchisees must ensure that all subcontractors or agents that handle PHI on their behalf agree to the same restrictions and conditions. This includes entering into a business associate agreement with any subcontractors to whom PHI is disclosed, ensuring compliance with HIPAA regulations. Franchisees must use appropriate safeguards to prevent misuse or unauthorized disclosure of PHI, and must notify the Covered Entity (the franchisee) of the location of any PHI. Franchisees must also make reasonable efforts to limit the use, disclosure, or request for PHI to the minimum amount necessary to accomplish the intended purpose, in accordance with HIPAA requirements.