The following terms used throughout this rule are defined as follows:

1. (1)

   1. (A) “Business associate” means one who acts for, or on behalf of, a participating entity to perform a function or activity involving the use or disclosure of protected health information, including:

      1. (i) Claims processing or administration;
      2. (ii) Data analysis, processing, or administration;
      3. (iii) Utilization review;
      4. (iv) Quality assurance;
      5. (v) Billing;
      6. (vi) Benefit management;
      7. (vii) Practice management and repricing; or
      8. (viii) Any other function or activity;
   2. (B) See 45 C.F.R. § 160.103;
2. (2) “Individual” means those persons whose protected health information is transmitted using the State Health Alliance for Records Exchange;

3. (3)

   1. (A) “Office of Health Information Technology” is a business associate of the participating entities who are covered entities under HIPAA.
   2. (B) The Office of Health Information Technology accepts and agrees to follow terms applicable to the privacy of protected health information by virtue of its business associate agreements with participating entities and these privacy policies; and

4. (4)

   1. (A) “Participating entities” means those entities which provide data to the State Health Alliance for Records Exchange and those entities which obtain and use data from the State Health Alliance for Records Exchange as health care providers, health plans, or health care clearinghouses, collectively "covered entities" as defined by HIPAA.
   2. (B) All participating entities are covered entities under HIPAA or have signed participation agreements with the Office of Health Information Technology.
   3. (C) Participating entities should not be confused with “individuals” whose protected health information is exchanged using the State Health Alliance for Records Exchange.

Codification Notes: This part, as promulgated prior to codification as the Code of Arkansas Rules, contained a footnote to 25 CAR § 20-101(4) as follows: “45 C.F.R. § 160.103”. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191.