Okla. Admin. Code § 340:2-8-12

Current through Vol. 42, No. 7, December 16, 2024

Section 340:2-8-12 - Business associate

(a) A business associate, per Section 160.103 of Title 45 of the Code of Federal Regulations ( 45 C.F.R. § 160.103) , is defined as an individual or entity who:

(1) performs on behalf of the Oklahoma Department of Human Services (DHS), any function or activity involving the use or disclosure of protected health information (PHI); and

(2) is not a member of the DHS workforce.

(b) The definition of "function or activity" includes:

(1) claims processing or administration;

(2) data analysis and data processing;

(3) utilization review;

(4) quality assurance; and

(5) billing, actuarial accounting, and other financial services.

(c) DHS discloses a client's PHI to a business associate, and allows a business associate to create or receive PHI on behalf of DHS.

(d) DHS enters into a contractual agreement with a business associate, per 45 C.F.R. § 164.504(e). The contract includes the appropriate language and provisions required by the federal Health Insurance Portability and Accountability Act Privacy Rule regarding the proper use and disclosure of PHI.

Okla. Admin. Code § 340:2-8-12

Added at 20 Ok Reg 2907, eff 8-21-03 (emergency); Added at 21 Ok Reg 784, eff 4-26-04

Amended by Oklahoma Register, Volume 36, Issue 24, September 3, 2019, eff. 9/16/2019