The Department of Health and Human Services (HHS) defines a business associate as “a person or organization, other than a covered entity’s workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of individually identifiable health information.” After the passage of the Health Information Technology for Economic and Clinical Health (HITECH), business associates are now required to comply with each of the administrative, technical, and physical safeguards under HIPAA. Most, if not all, EMR vendors are business associates since they handle individually identifiable health information of a practice’s patients as they facilitate the transition from a paper to a digital environment. HIPAA compliance essentially is an entry point for EMR vendors to conduct business with healthcare organizations.

Requiring EMR vendors to comply with the HIPAA regulations, ensures that more provider/vendor dialog will occur regarding the necessary Business Associate Agreements, and regarding other compliance issues of mutual interest. Vendors are generally quick to sign Business Associate Agreements with a practice, but often have not fully implemented each of the policies and procedures under HIPAA. Since federal and state governments have made it clear that HIPAA enforcement is a top priority, healthcare organizations and EMR vendors need to be cautious of the landscape and must make HIPAA compliance part of their organization’s culture. It is advisable that healthcare organizations keep these considerations in mind when shopping for an EMR—simply signing a Business Associate Agreement is insufficient. The vendor’s compliance with HIPAA regulations is telling of the company’s dedication to conducting business in an appropriate manner. Surprisingly, very few EMR vendors maintain a culture of HIPAA compliance within their organizations. This makes it easy for a practice to identify the vendors that are in the business for the long-run.

TechComply offers unique, comprehensive guidance and implementation services designed to assure that your organization selects the right EMR.