While the majority of the compliance procedures are the responsibility of the individual medical entity, you may be asked to sign a Business Associate Contract regarding confidentiality of medical information. Entities covered by HIPAA must obtain satisfactory assurances that their Business Associates will appropriately safeguard protected health information it receives or creates on behalf of the covered entity. Satisfactory assurances must be in writing.

Good news for the property manager, though –landlord, janitorial and maintenance services do not fall under HIPAA's definition of Business Associate. This means when your tenants call you requesting, or in some situations demanding, that you sign the Business Associate Contract, you are not required to do so. You will find that almost

every tenant has a different interpretation of the regulation; however, it is clearly stated that only service providers whose access to private medical data is imperative in order to do their job (such as billing services, transcription, etc.) fall under the Business Associate standard. Landlords and facility-related functions such as janitorial and maintenance services are excluded due to having only “incidental” access, such as a file being out on a counter when the building's staff walks through the office.