SECTION 340:2-8-12. Business associate

(a)   A business associate, per Section 160.103 of Title 45 of the Code of Federal Regulations (45 C.F.R. § 160.103), is defined as an individual or entity who:

(1)   performs on behalf of the Oklahoma Department of Human Services (DHS), any function or activity involving the use or disclosure of protected health information (PHI); and

(2)   is not a member of the DHS workforce.

(b)   The definition of "function or activity" includes:

(1)   claims processing or administration;

(2)   data analysis and data processing;

(3)   utilization review;

(4)   quality assurance; and

(5)   billing, actuarial accounting, and other financial services.

(c)   DHS discloses a client's PHI to a business associate, and allows a business associate to create or receive PHI on behalf of DHS.

(d)   DHS enters into a contractual agreement with a business associate, per 45 C.F.R. § 164.504(e). The contract includes the appropriate language and provisions required by the federal Health Insurance Portability and Accountability Act Privacy Rule regarding the proper use and disclosure of PHI.

[Source: Added at 20 Ok Reg 2907, eff 8-21-03 (emergency); Added at 21 Ok Reg 784, eff 4-26-04; Amended at 36 Ok Reg 1777, eff 9-16-19]