Healthcare payment privacy
Ask about the service and data flow before asking for a BAA.
A business-associate agreement depends on the role a vendor performs and the information involved. Conventional payment processing and additional healthcare data services can raise different questions.
By Fluid Financial
What HHS guidance says
HHS distinguishes certain consumer-conducted financial transactions from services performed on behalf of a covered entity that involve PHI. A vendor’s title alone does not resolve the question; review the actual service and data flow.
Source: HHS: Business Associates guidance.
Prepare these questions for your compliance team
- Is the vendor only facilitating a consumer payment, or providing additional services involving PHI?
- What information does the vendor create, receive, maintain, or transmit?
- Which subcontractors or connected services are involved?
- What agreements apply, and are their scopes consistent with the proposed services?
- Who is responsible for safeguards, retention, access, and incident response?
Where MedToken fits
MedToken is designed to remove unnecessary PHI at the transaction processor before a second token is transmitted to the financial-services provider. That does not determine the responsibilities of every other system or vendor in the organization’s workflow.
Review the proposed MedPay+ arrangement with your legal or compliance adviser and ask Fluid to identify the processing and technology services involved.
This discussion guide is general information, not a determination of whether a BAA is required for your organization.
Review your healthcare payment workflow
Discuss MedToken, your processing requirements, and how MedPay+ could fit your organization.
Request a Technical Review