340:2-8-12. Business associate
(a) A business associate, per Section 160.103 of Title 45 of the Code of Federal Regulations (45 C.F.R. § 160.103), is defined as an individual or entity who:
(1) performs on behalf of the Oklahoma Department of Human Services (DHS), any function or activity involving the use or disclosure of protected health information (PHI); and
(2) is not a member of the DHS workforce.
(b) The definition of "function or activity" includes:
(1) claims processing or administration;
(2) data analysis and data processing;
(3) utilization review;
(4) quality assurance; and
(5) billing, actuarial accounting, and other financial services.
(c) DHS discloses a client's PHI to a business associate, and allows a business associate to create or receive PHI on behalf of DHS.
1.Questions regarding the status of a vendor or independent contract are forwarded to the privacy officer, per Oklahoma Administrative Code 340:2-8-5.