Hey Dentists: No Business Associate Agreement, No Problem

The HIPAA Privacy Rule applies to covered entities (including dental practices) and their business associates.  As you know, for the past few years, dental practices have been the target of increased HIPAA audits by the OCR.  On March 22, 2017, the American Dental Association (ADA) announced[1] that OCR had clarified to the ADA that a dental laboratory is not a dentist’s business associate when the communication is for treatment purposes.  Specifically, in its correspondence to the ADA, the OCR said, “a covered entity such as a dentist is not required to have a business associate agreement with another health care provider such as a dental laboratory when disclosing [protected health information] for treatment of an individual.”

It’s important to note, this clarification is not a blanket exemption from the requirement to have business associate agreements between dental practices and dental laboratories.  In certain instances, business associate agreements are still required, for example the OCR pointed out that if the laboratory provides “other (nontreatment) services or functions on behalf of the provider that fall within the definition of business associate and require access to protected health information.”