A controller at a multi-building skilled nursing group is halfway through a procurement software contract review when the compliance officer sends back one question, whether the vendor needs a business associate agreement. Most of what the software will read is thickener for dietary or gloves for central supply, coded to a department. The wound care nurse also orders a specialty dressing for one resident, and the vendor's invoice line for that dressing carries a room number.
Procurement software needs a BAA when the vendor will create, receive, keep, or send protected health information while performing a function or service for the operator, which is how HIPAA defines a business associate. If none of the orders and invoices the software will hold can identify a resident, that definition is not met, and the operator's compliance officer makes that call.
A business associate agreement, or BAA, is the contract HIPAA requires between a covered entity and a vendor that handles protected health information on its behalf. The definition of a business associate in 45 CFR 160.103 covers a company that "creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter" on behalf of the covered entity. Storing an invoice image that carries a resident identifier is maintaining that information, and passing the invoice to the accounting system is transmitting it.
Where does PHI show up in purchasing data?
Protected health information shows up in purchasing data on the lines that point at one resident. A stock order lists an item and a quantity against a department. A resident-specific order for a dressing or an enteral formula is the line to look at, and the vendor's invoice can repeat whatever the order carried.
Whether a room number or a resident ID on that line is enough to identify the resident is a decision for the compliance officer, who reads the definition of protected health information in 45 CFR 160.103 in full. Run the same check on each record the software will hold.
| Purchasing record | What to look at before deciding |
|---|---|
| Stock order (gloves, thickener) | The line lists an item and a quantity against a department. |
| Resident-specific order (specialty dressing, enteral formula) | Whether the line carries a name, a room number, a resident ID, or a date of service. |
| Invoice image or PDF | Whatever the vendor printed, which can repeat the identifiers on the order. |
What has to be in a BAA?
The required contract terms for a business associate sit in 45 CFR 164.504(e)(2). That paragraph lists more requirements than the three in the table. The three in the table are the ones a buyer can check on a sales call, because each has a plain answer.
| The regulation's words | What to ask the vendor |
|---|---|
| "Establish the permitted and required uses and disclosures of protected health information by the business associate" | Which of our records will you hold, and for what? |
| Provide that the business associate will "not use or further disclose the information other than as permitted or required by the contract or as required by law" | Who else can open our invoice images, and for what purpose? |
| "Authorize termination of the contract by the covered entity, if the covered entity determines that the business associate has violated a material term of the contract" | If you break the BAA, can we terminate it? |
Counsel reads the vendor's standard BAA against the whole paragraph. None of this is legal advice. Ask early whether the vendor will sign the operator's BAA form or only the vendor's own template.
What to ask a procurement software vendor about HIPAA
The first question for a procurement software vendor is which records the software will hold, down to the invoice image, and where those files are stored. Then ask how an invoice travels from invoice capture to the accounting system, because the file that moves is the one with the resident identifier on it. The phrase HIPAA-compliant on a vendor's website is the vendor's own statement, so ask what it rests on. A vendor that says it never sees protected health information should be able to name the records it holds and show that none of them carry a resident identifier.
In Adelpo, each location has a designated email address, and an invoice sent to it uploads into Adelpo Capture as a PDF, an EDI file, or an image. The operator chooses whether facility staff or only the corporate office sends invoices in. Capture splits each invoice line by line unless the operator asks to consolidate, and the accounting system receives the invoice PDF and the line items with their GL codes, by connection to Sage Intacct or QuickBooks or by automatic batch import for NetSuite and other systems. Adelpo signs a BAA.
Questions controllers ask
does procurement software need a baa if we only order supplies?
Procurement software needs a BAA only if it will handle protected health information for you. If every line is a stock item coded to a department, there is nothing for the business associate test in 45 CFR 160.103 to attach to. If one wound care line will pass through with a resident identifier on it, have the compliance officer look at that line before you sign.
can a vendor invoice contain phi?
A vendor invoice can contain PHI when a line is for one resident and carries something that identifies that resident. A common case in a nursing home is a dressing ordered for one resident with a name or a room number printed on the line. Whether a given identifier is enough is the compliance officer's call under the definition in 45 CFR 160.103.
what should a baa with a software vendor say?
A BAA with a software vendor has to contain at least what 45 CFR 164.504(e)(2) lists, which is more than a sales call covers. Start with the term that sets what the vendor may do with the information and the term that lets you end the contract if the vendor violates a material term. Counsel reads the full paragraph against the vendor's template before anyone signs.