Medical courier services sign HIPAA Business Associate Agreements because they qualify as Business Associates under HIPAA whenever they transport Protected Health Information on behalf of a covered entity. A Business Associate Agreement is a legal requirement that must be executed before any PHI passes between the covered entity and the courier organization, establishing the terms under which PHI may be handled and the compliance obligations each party must fulfill. The agreement is not optional and cannot be waived by either party. A covered entity that discloses PHI to a medical courier without a valid Business Associate Agreement in place has made an impermissible disclosure regardless of whether any further violation occurs, and the courier organization that receives PHI without a signed agreement is operating outside the legal framework that governs its handling of that information.
What the Agreement Defines for Courier Operations
A Business Associate Agreement signed by a medical courier service defines the permitted uses and disclosures of PHI in the course of the courier’s operations, the security safeguards the courier must implement, and the incident reporting obligations the courier owes to the covered entity when a security event affects PHI during collection, transport, or delivery. It also specifies the terms under which the agreement may be terminated, which covered entities exercise when a Business Associate experiences a significant data breach or demonstrates inadequate compliance practices. A signed Business Associate Agreement normally commits the courier organization to compliance standards that individual employees must understand and apply in their daily work. The HIPAA Journal’s HIPAA Certification for Medical Couriers satisfies the requirement with respect to knowledge of HIPAA rules and regulations.
