JOIN AOTA

FAQ

What is HIPAA?
What is a "covered entity"?
What is a business associate?
Do schools and fieldwork programs fall under "Business Associate" status?
Is training required for occupational therapy and occupational therapy assistant students?
Must fieldwork contracts be updated to include a HIPAA statement?
What are the consequences, if any, if a student violates the policy while on fieldwork?

What is HIPAA?

The Health Insurance Portability and Accountability Act, otherwise known as HIPAA, was enacted by Congress in 1996 to address insurance portability (when moving from employer to employer), to reduce fraud, and to protect confidential medical information.

What is a "covered entity"?

Under HIPAA, this is a health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a HIPAA transaction.

What is a business associate?

A business associate is a person or organization that performs a function or activity on behalf of a "covered entity."

Back to top

Do schools and fieldwork programs fall under "business associate" status?

There has been much discussion as to whether a fieldwork contract requires schools to become "business associates" and therefore fall under the HIPAA requirements for each contract.

The decision of whether or not to become a business associate lies with each school. But the argument can be made that the occupational therapy and occupational therapy assistant students and the schools are not business associates using the following information:

  • A Business Associate Agreement is required by HIPAA where a person or entity provides services for a covered entity that involve access to patient health information.
  • An exception to that is a person who performs "in the capacity of a member of the workforce of [a] …covered entity".
  • 45 CFR Sec. 160.103 defines members of the "workforce" as "employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity, is under the direct control of such entity, whether or not they are paid by the covered entity.
  • There is a specific exception indicating that a Business Associate Agreement is not required for persons or entities involved in a patient's treatment. 45 CFR 164.502(e)(1).

Back to top

Is training required for occupational therapy and occupational therapy assistant students? If so, how can it be accomplished?

In order to meet HIPAA guidelines, individual fieldwork sites will require students to be trained, according to HIPAA standards, to follow privacy and confidentiality guidelines. Sites may meet this objective in several ways. They may send a video to the school and require that student watch the video prior to beginning the fieldwork. They may accept HIPAA training that is covered in the academic coursework, or they may stipulate that all HIPAA training be completed at their facility. It is important to remember that the fieldwork site is responsible for making sure that students meet the HIPAA guidelines as interpreted by their facility, and that there is clear communication between fieldwork site(s) and the school regarding how the school can best help meet those requirements.

Must fieldwork contracts be updated to include a HIPAA statement?

For any site that is required to meet HIPAA guidelines, the contract should be updated to reflect any changes in responsibility by the school or the site. This is true with any fieldwork contractual agreement - the contract should reflect shared responsibilities as well as individual responsibilities of the school and the fieldwork site. The school or fieldwork site can choose to initiate these changes per contract guidelines.

Back to top

What are the consequences, if any, if a student violates the policy while on fieldwork?

If a student violates HIPAA guidelines while on fieldwork, the school and fieldwork site should develop an action plan to address the issue. While up to the site and/or school, possible steps to take could range anywhere from a review of HIPAA policy to removal of the student from fieldwork - depending upon the severity of the violation. Schools should work with fieldwork sites so that the action taken with a student violation is similar or no greater than an action that would be taken with an employee.

Guidance on language regarding Business Associate status provided by Susan Levy Wayne and and Nancy Cribbs, LLB, Cleveland State University

Last Update: 04/07/04