Written by Ashley Robertson
If your office is thinking about engaging a third party medical records management firm to handle requests for access and store your data—or if you have already done so—you undoubtedly know that you need a business associate agreement in order to comply with HIPAA. This business associate agreement will require the medical records company to provide “satisfactory assurances” that it will, among other things, “help the covered entity comply with some of the covered entity’s duties under the Privacy Rule.”
You’ll also want to make sure that your contract with any such company requires it to comply with Tennessee state law with regard to limitations on medical records copying fees that can be charged to those requesting medical records.
