Who does HIPAA consider a subcontractor?

Subcontractors in healthcare can be organizations assisting business associates with their duties related to managing protected health information (PHI). This includes third-party telehealth providers and messaging apps integrated into practice management systems.

What is a subcontractor?

A subcontractor, according to 45 CFR 160, is a person or entity to whom a business associate delegates a specific function, activity, or service. This delegation occurs outside the context of being a part of the business associate's workforce.

HHS states that "Subcontractor means a person to whom a business associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate."

In essence, subcontractors are individuals or organizations that perform functions for or provide services to a business associate, and these functions often involve handling protected health information. 

Business associates may engage subcontractors to carry out tasks related to processing, maintaining, or transmitting protected health information, and they are subject to compliance with the applicable Privacy and Security Rule provisions under HIPAA. 

See also: How HIPAA defines subcontractors

Examples of subcontractors

1. Medical billing companies: These subcontractors handle the billing and coding of medical services for healthcare providers, ensuring accurate claims submission and reimbursement.
2. Medical transcription services: Subcontractors in this category transcribe physicians' voice-recorded notes into written reports, helping to maintain accurate patient records.
3. Pharmacy benefit managers (PBMs): PBMs manage prescription drug benefits for health insurance plans, processing and fulfilling medication orders for patients.
4. Medical equipment suppliers: These subcontractors provide medical equipment and supplies such as wheelchairs, oxygen tanks, or home medical devices.
5. Clinical laboratories: Laboratories may subcontract certain testing services to specialized labs for specific diagnostic tests, like genetic testing or pathology services.
6. Radiology services: Imaging centers and hospitals may subcontract radiology services for interpreting X-rays, MRIs, and other medical images.
7. Pharmaceutical contract manufacturers: These subcontractors are involved in drug manufacturing, helping pharmaceutical companies produce medications efficiently. 
8. Telehealth service providers: With the rise of telemedicine, subcontractors in this category offer virtual healthcare services, connecting patients with healthcare professionals.
9. Health Information Management (HIM) companies: HIM subcontractors manage patient records, including digitizing, organizing, and ensuring compliance with data privacy regulations.
10. Medical waste disposal services: These subcontractors specialize in the safe collection and disposal of medical waste generated by healthcare facilities.
11. Credentialing and verification services: These services ensure that healthcare professionals, such as doctors and nurses, meet licensing and credentialing requirements.
12. Home healthcare services: Subcontractors can provide in-home healthcare services, including skilled nursing, physical therapy, and home health aides.

See also: HIPAA Compliant Email: The Definitive Guide

Advantages of utilizing subcontractors

Subcontractors can provide specialized skills and services, often at a lower cost than maintaining an in-house team for those functions. This arrangement allows the business associate to focus on its core activities while subcontractors handle specific tasks, such as billing, data analysis, or legal services. 

See also: Does a subcontractor have to sign a BAA?