title: The HIPAA privacy rule and HR/benefits outsourcing: does the business associate label belong on your recordkeeper?
abstract: Employers that sponsor group health plans and serve as the plan administrator of those plans are required by the HIPAA Privacy Rule to execute business associate contracts with vendors that provide services on behalf of the plans. The business associate contracts must contain many specific provisions regarding the protection, use and disclosure of health information. This article looks at the implications of imposing business associate contract obligations on an integrated HR and benefits-outsourcing recordkeeper and cautions employers against an overly broad application of the requirements.
authors.forename: Denise D
authors.initials: DD
authors.lastname: Hilger
mesh_terms: D003219:Confidentiality / Q000331:legislation & jurisprudence*; D004649:Employee Incentive Plans; D005376:Financial Management; D005568:Forms and Records Control / Q000331:legislation & jurisprudence*; D006264:Health Benefit Plans, Employee / Q000331:legislation & jurisprudence / Q000458:organization & administration*; D020408:Health Insurance Portability and Accountability Act; D006801:Humans; D009935:Organizational Affiliation; D020416:Outsourced Services / Q000331:legislation & jurisprudence*; D012456:Salaries and Fringe Benefits; D013192:Staff Development; D014481:United States