As regards what it means to have `routine access` to [PHI] in order to determine which types of data transmission services are business partners compared to mere channels, such a provision will be based on specific facts, depending on the type of services provided and the extent to which the undertaking needs access to [PHI] in order to provide the service to the entity concerned. The channel exception is narrow and is intended to exclude only companies that provide pure messaging services, such as the U.S. Postal Service or United Parcel Service and their electronic equivalents, such as Internet Service Providers (ISPs), that provide pure data transmission services. As we have mentioned in previous guides, a conduit carries information but does not access it, except accidentally or rarely when it is necessary to provide the transport service or as required by other laws. For example, a telecommunications company may have occasional and random access to [PHI] when it verifies that the data transmitted over its network arrives at the intended destination. Such occasional and random access to [PHI] would not qualify the Company as a business partner. By contrast, an entity that needs access to [IHP] to perform a service for a covered entity, e.B. a health information organisation that manages the exchange of [IHP] on a network on behalf of the entities collected using record locator services for its subscribers (and other services), is not considered a channel and is therefore not excluded from the definition of trading partner. The HIPAA Privacy Policy describes the types of entities covered by HIPAA and the entities that must follow HIPAA security and privacy policies. The main categories are clearing houses, covered entities (EC) and counterparties.

The further away the subcontractor is from the covered entity, the more confusion there is as to who is really a business partner and who should sign a business partnership agreement. The functions and activities of business partners include: handling or managing complaints; data analysis, processing or management; Verification of use; quality assurance; Invoicing; performance management; practice management; and re-evaluation. Services to business partners include: legal; actuarial science; Accounting; Council; data aggregation; Management; administratively; Accreditation; and financially. See the definition of “trading partner” in 45 CFR 160.103. HipAA requires covered entities to only work with business partners who provide comprehensive protection for PSR. These assurances must be made in writing in the form of a contract or other agreement between the covered entity and the BA.1 Whenever a health care provider or provider hires a contractor to process protected health information as part of their assigned work, both parties must sign a BAA. Once the covered companies, business partners and subcontractors of the business partners have identified their relationship with each other, it is important to ensure that third parties protect the PSR they receive. A signed agreement documents that the BA knows it must manage IHP safely. .