Just a few points for your consideration ...

* Pin down the HIPAA relationship with the vendor. Is the vendor the provider, and your organization the business associate? Or the other way around? For example, Sedgwick County contracts out medical services for prisoners, the medical vendor is the services provider, medical records are the vendor's (as I understand), and Sheriff is a HIPAA "business associate" to the vendor.

* If you have a situation in which a business associate vendor creates or receives records subject to HIPAA, ensure you take possession of the records after expiration of the contract. For example, EMS (ambulance) billing is contracted out here, and we recently had to take in about 450 boxes of billing records for the past contract period, when the vendor didn't win the bid for the next period.

* Add provisions in any contract regarding compliance with HIPAA and state laws.

* State medical privacy and retention laws may apply. They may be more stringent than HIPAA, and HIPAA defers to more stringent state laws.

* If your "medical evaluations" are for worker comp purposes, then HIPAA may not apply. As I recall, HIPAA specifically excludes worker comp, but see the next bullet.

* Get competent legal advice.

Good luck!

// Douglas K. King, Records Manager / Freedom of Information Officer
|| Sedgwick County DIO/IT-Records Management Services
|| Sedgwick County Courthouse / 525 N. Main /  Wichita KS 67203
|| 316.660.9846   FAX 316.660.3274   mailto:[log in to unmask]
\\  www.sedgwickcounty.org   "Sedgwick County ... working for you"

-----Original Message-----
From: Records Management Program [mailto:[log in to unmask]]On
Behalf Of Steve Shalagan
Sent: Friday, December 29, 2006 9:09 AM
To: [log in to unmask]
Subject: [RM] HIPPA AND MEDICAL RECORDS

We are in the process of evaluating the possibility of using a 3rd party
vendor for medical evaluations. I would appreciate any questions or
comments about the idea as it relates to concerns and questions
regarding Medical Records, HIPPA, etc...   

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance