1. What are these common HIPAA terms: "BA", "CE" and "TPO"?

BA –“BA” stands for “Business Associate” – a person or entity not employed by the University that provides certain functions, activities, or services for or on behalf of the University that involve the use and/or disclosure of the University's Protected Health Information. Such activities may include, but are not limited to, billing; repricing; claims processing and administration; data analysis; legal, accounting, actuarial, consulting, utilization review and quality assurance; and similar services or functions. A Business Associate may be a Covered Entity. (The definition of a Business Associate excludes a person who is part of the Covered Entity’s workforce.)

CE –“CE” stands for a “Covered Entity” and refers to the entities to which the Privacy Regulations apply. There are 3 types of covered entities: (1) health plans; (2) health care clearinghouses; and (3) health care providers who transmit any health information in electronic form in connection with one of the HIPAA standard transactions. The University is a hybrid Covered Entity.

TPO – "TPO" stands for Treatment, Payment, and Operations. PHI may be disclosed to authorized individuals for TPO without patient authorization.

Return to FAQ List