HIPAA Compliance & Change of Ownership (Healthcare Deals)
April 29, 2019
by a searcher from Northwestern University - Kellogg School of Management in Denver, CO, USA
For those of you who have done healthcare deals - is there a standard approach to transferring patient data and records in a change-of-ownership scenario, in a HIPAA-compliant manner, without getting individual patient consents? Thanks in advance for any answers!
from Northwestern University in Denver, CO, USA
"'A covered entity may use or disclose protected health information for its own......health care operations." 45 C.F.R###-###-#### c)(1). The term "health care operations" includes "the sale, transfer, merger, or consolidation of all or part of the covered entity with another covered entity.....' Id. at###-###-#### ."
http://www.ncpa.co/pdf/WP-selling-assets-transferring-patient-files.pdf
The definition of "health care operations" is condensed in the article, but the full section that is relevant here reads:
(6) Business management and general administrative activities of the entity, including, but not limited to: (iv) The sale, transfer, merger, or consolidation of all or part of the covered entity with another covered entity, or an entity that following such activity will become a covered entity and due diligence related to such activity.