Does an adult family home need a BAA with its documentation app?
If your adult family home is a HIPAA covered entity, yes. A health care provider is covered when it submits standard transactions, such as claims, electronically. A covered entity needs a business associate agreement with any vendor that handles resident health information for it. Washington's own rules require confidential, protected records either way.
This is general information, not legal advice. For your home's situation, ask a compliance advisor.
Is your home a covered entity?
According to CMS, HIPAA covered entities are health plans, clearinghouses, and health care providers who submit HIPAA transactions, such as claims, electronically (CMS). Whether your adult family home is covered depends on how it handles those transactions, not on its size. CMS publishes a covered entity decision tool on the same page.
What a business associate agreement does
If a covered entity uses an outside business to help with its health care work, it needs a written contract with that business. CMS says the contract sets out what the business is engaged to do and requires it to protect the health information. A documentation app that stores your residents' notes is that kind of business.
Confidentiality applies either way
Even if HIPAA doesn't apply to your home, Washington's adult family home rules do. Resident records must be confidential and protected from loss, alteration or unauthorized use, and released only in the situations the rule allows (WAC 388-76-10315).
What to ask a vendor
- Will you sign a business associate agreement?
- Where is the data stored, and is it encrypted?
- Does every caregiver sign in with their own account?
- Are changes recorded, so you can see who did what?
- Can we export everything if we leave?
Divinity offers a business associate agreement that owners accept when they sign up. Data is stored on Google Cloud in the United States and sent over encrypted connections, everyone signs in with their own account, and every change is recorded.
Frequently asked questions
Is there such a thing as a "HIPAA certified" app?
The federal government doesn't certify apps as HIPAA compliant. Ask whether the vendor will sign a business associate agreement and how it protects your data.
Do Washington's rules protect resident records even without HIPAA?
Yes. WAC 388-76-10315 requires confidential, protected records and limits who they can be released to.
Sources
See whether Divinity fits your home
A short call, specific to your home and your staff. Or start on your own with a free trial. Prefer to look first? Watch the 90-second tour.