Treatment, Payment or Operations (T.P.O.)
The official definition of T.P.O. via HHS reads as, “The HIPAA Privacy Rule establishes a foundation of Federal protection for personal health information, carefully balanced to avoid creating unnecessary barriers to the delivery of quality health care. As such, the Rule generally prohibits a covered entity from using or disclosing protected health information unless authorized by patients, except where this prohibition would result in unnecessary interference with access to quality health care or with certain other important public benefits or national priorities. Ready access to treatment and efficient payment for health care, both of which require use and disclosure of protected health information, are essential to the effective operation of the health care system. In addition, certain health care operations—such as administrative, financial, legal, and quality improvement activities—conducted by or for health care providers and health plans, are essential to support treatment and payment.”
Essentially, this states that services which are absolutely integral to the continuance of your Organization need no particular agreement in place to satisfy HIPAA requirements. Since you need these services in order to continue to treat patients, receive remuneration for doing so, or to carryout day-to-day health care operations no B.A.A. is necessarily needed for some services you may have assumed otherwise about. This goes for giant Insurance Companies (Blue Cross/Blue Shield, United Healthcare), but also trickles it’s way down to any Labs you may work along side with. Lents fitters, frames manufacturers, drug reps who stay away from being behind the counter – All of these do not require a B.A.A.
This ties back to the Seven Fundamentals of Effective Compliance Plan by, “Developing effective lines of communication.”