BAAs, Records Custody and HIPAA in a PC and MSO Structure: Who Owns the Chart and Who Handles It
The medical chart belongs to the physician-owned practice. The management company often hosts the systems that hold it. The business associate agreement and a records custody addendum are what make that arrangement lawful and keep the patient's information protected.
Key Highlights
- The PC owns the medical record, and the management company processes it as a business associate under a written BAA.
- A records custody addendum spells out who holds the records, how they are accessed and what happens if the relationship ends.
- The management company's access should be limited to what its functions need.
- HIPAA policies, training records and delegation logs are part of the compliance file.
Who Owns the Chart
Medical records belong to the practice that provides care, which in this structure is the physician-owned PC. The management company hosts systems, supports the EHR and runs administrative functions that touch patient information, but it does not own the chart. That distinction matters in a records request, a board inquiry, a sale, and when the relationship ends.
The Business Associate Agreement
Under HIPAA, a company that handles protected health information on behalf of a covered entity is a business associate and must sign a business associate agreement. The BAA sets out what the management company may do with the information, the safeguards it must maintain, how breaches are reported and what happens to the data at termination. In a PC and MSO structure, the BAA is a core document, not a formality.
The Records Custody Addendum
A records custody addendum to the management agreement covers the practical questions: where records are held, who may access them and for what purpose, how the practice gets a complete copy on request, and how continuity of patient care is protected if the arrangement ends. It supports the position that the PC owns the chart and the management company is a custodian.
Limits on Access
The management company's access should be limited to what its administrative functions need. It should not reach into charts to influence clinical decisions, and the agreement should say so. Limiting access is both a privacy safeguard and a structural one, because a management company with unrestricted chart access looks more like a participant in clinical decisions.
The Rest of the Privacy File
- term: text
- term: text
- term: text
- term: text
Disclaimer
This article is general educational information, not legal advice. State law varies and changes, and depends on the facts of a clinic's structure, so confirm specifics with health care regulatory counsel.
MedGrid MSO provides management services to independently owned practices; it does not practise medicine and does not direct clinical decisions. Requirements vary by state and by service, and change over time — nothing on this page is legal or medical advice. Talk to us or your own counsel before making a structural decision for your clinic.