Business Associate Decision Tree

Does the entity provide services on behalf of DPH? 

• No.  The entity is not a business associate.  
• Yes. Go to Step 2. 

Will the entity create, receive, maintain, or transmit protected health information (PHI) on behalf of DPH? 

• No.  The entity is not a business associate. 
• Yes. Go to Step 3. 

Is it an individual healthcare provider who is receiving PHI for the purpose of treating an individual? 

• No.  Go to Step 4. 
• Yes. The entity is not a business associate. 

Does the entity perform a service for DPH involving PHI (e.g., healthcare operations or payment functions)?

OR

Does the entity provide legal, accounting, consulting, data aggregation, management, administrative, or other similar services for DPH?

OR

Does the entity provide data transmission services with respect to PHI and the entity requires access to the PHI on a routine basis (i.e., the entity is not merely the conduit for the PHI)?
 

• Yes. Go to Step 5.
• No.  The entity is not a business associate.