The Health Insurance Portability and Accountability Act (HIPAA) restricts transferring or disclosing certain patient-related information. When buying an active health care business, at some point patient’s information must be transferred to the buyer. Proactive preparation for HIPAA compliance is grounded in due diligence. Due diligence is not as straightforward for healthcare transactions as it is for non-healthcare transactions. Due diligence allows for parties to be aware of risks and ensure that the assertions made are true and backed by evidence.

How the HIPAA Law Works

Any transfer of information that may require disclosure of patient information triggers HIPAA concerns. When a seller is transferring financial information to the buyer, including but not limited to insurance claims documents, or accounts receivable, this information may include Individually Identifiable Health Information (IIHI) or Protected Health Information (PHI). The HIPAA law protects both IIHI and PHI from disclosure in certain circumstances. Furthermore, general business documents such as patient history records, administrative complaints, past or ongoing litigation documents, and compliance records may include patient information, which would violate HIPAA if disclosed without the proper precautions. 

As a general matter, a patient can provide authorization to disclose his or her IIHI or PHI. In the absence of patient consent, there are certain instances in which the patient’s information can be disclosed. These circumstances require sufficient safeguards to protect the patient’s information and impose limits on what information is disclosed to what is “minimally necessary” to satisfy the request.

Avoiding Non-Compliant HIPAA Action

To avoid non-compliant HIPAA action, the seller should secure each patient's disclosure authorization before closing or ensure that there are legal provisions that allow such disclosure. The parties should also have in place a detailed outline that specifies:

• When and how the seller will transmit the patient’s medical records to the buyer;
• Who is responsible for ensuring that the transfer of patient records complies with HIPAA and any applicable state laws; 
• A plan if the transfer results in the loss or destruction of any patient data.

Continuing compliance with HIPAA is vital to the transferred health care business post-sale.

To speak with an experienced health care lawyer who understands how to negotiate and plan for the purchase of a health care business, contact Howell, Buchan & Strong Attorneys at Law for a free consultation.

Have questions about buy/sell agreements or contracts? Contact the law firm of Howell, Buchan & Strong at 850-877-7776 to set up a FREE, no-obligation consultation. Our firm represents licensed professionals statewide. 

Orlando (407) 717-1773 | Tallahassee (850) 877-7776 | Tampa (813) 833-6726 | Sarasota (941) 779-4348