Re: HIPAA Business Associate/Identity Theft Prevention Agreement

["Lorenz, Eva" <evalorenz () UNC EDU>]

Red Flag Rules are based on ID theft protection, HIPAA applies to covered entity interaction involving PHI, two very 
different frameworks.
Red Flag Rules list a number of different situations that may subject an entity to the requirements.
As others have stated, without being familiar with either the way you handle the specific financial transactions 
triggering the RFR request or interact with the hospital regarding patient information, it is impossible to determine 
whether the requests are reasonable.
If HIPAA applies to you as a BA, then the HITECH will come into play as well with the more stringent requirements for 
Business Associates.



From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Steven 
Bourdon
Sent: Monday, February 22, 2010 1:44 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] HIPAA Business Associate/Identity Theft Prevention Agreement

Hello All,

I just received an agreement from a local hospital requesting we sign as a "business associate" under HIPAA and 
"service provider" for FTC Red Flag Rules.   Other than a nursing program with student clinical rotations performed at 
local hospitals we don't deal with protected health information on campus.  This is a new area for me so I'm curious if 
others have signed similar agreements for their health programs with local health providers for student clinical 
activities.

Thanks,

Steven M. Bourdon, CISO
South Texas College