Throughout the years, the prevalence of county hospitals operating nursing homes in Indiana has continually increased. By leasing the facility from the long-term care (LTC) provider, the county hospital becomes the license holder, and as a non-state government operated facility, the nursing home is now eligible to receive Medicaid upper payment limit supplemental payments.

In addition to the lease, the two parties will also enter into management agreement and Intangible Property Licensing Agreement (IPLA), and although the management agreement, lease and IPLA remain constant in these partnerships, questions still surround the need for one agreement – a business associate agreement.

While most health care providers and attorneys are familiar with the terms “business associate” and “covered entity” under the Health Insurance Portability and Accountability Act (HIPAA), an often overlooked term when determining whether two parties require a business associate agreement is “organized health care arrangement” (OHCA).

An OHCA means one of two things for providers:

• A clinically integrated system where patients receive care from more than one provider; or

• An organized system of healthcare in which more than one covered entity participates and the participants present themselves to the public as part of a joint arrangement. The joint activities of the participants must include at least one of the following: utilization review; quality assessment and improvement activities; or payment activities.

45 CFR 160.103.

Here, the hospital and LTC provider meet the definition because they hold themselves out to the public as participating in a joint arrangement and engage in joint quality assessment and improvement activities through the quality incentive fee standards found in the management agreement.

Under an OHCA, even though a covered entity provides services to the other covered entity that would typically fall within the role of a business associate, such as the LTC provider performing billing services, the covered entity providing such services is not considered a business associate. Further support for this is found in the definition of “business associate” under 45 CFR 160.103 subsection (4)(iv), which states a business associate does not include “[a] covered entity participating in an organized health care arrangement that performs a function or activity as described by paragraph (1)(i) of this definition for or on behalf of such organized health care arrangement, or that provides a service as described in paragraph (1)(ii) of this definition to or for such organized health care arrangement by virtue of such activities or services.”

Comments by the U.S. Department of Health and Human Services also reinforce this proposition: “As to disclosures among covered entities who participate in an organized health care arrangement, the Department clarifies that no business associate contract is needed to the extent the disclosure relates to the joint activities of the OHCA.” 67 Fed. Reg. 53181, 53252 (August 14, 2002).

Accordingly, a LTC provider should consider determining the necessity of a business associate agreement, as business associate agreements can hold numerous obligations in addition to what HIPAA requires, such as indemnification, additional insurance requirements, strict termination provisions and additional duties in the event of a breach.