What Is an Organized Healthcare Arrangement?
An Organized Healthcare Arrangement (OHCA) is a defined category under HIPAA that allows clinically integrated groups of covered entities to share PHI for their joint healthcare activities without needing business associate agreements between themselves. OHCAs recognize that in real-world healthcare delivery, multiple distinct covered entities often work closely together to provide coordinated care, and requiring formal BAAs between all of them would be impractical and potentially disruptive to patient care.
HIPAA defines an OHCA as: (1) a clinically integrated care setting where individuals typically receive healthcare from more than one covered entity; (2) an organized system of healthcare where the participating covered entities hold themselves out to the public as participating in a joint arrangement and they participate in joint activities, such as utilization review, quality assessment and improvement, or payment activities; or (3) a group health plan and a health insurance issuer that have an arrangement where the issuer provides insurance to the plan participants.
Common OHCA Examples
Common examples of OHCAs include:
- A hospital and its medical staff — physicians who have admitting privileges at a hospital but are not employed by it may form an OHCA with the hospital for their joint treatment activities.
- Physician group practices and the facilities where they practice
- Integrated delivery networks (IDNs) where multiple hospitals, physician practices, and other providers are clinically integrated under a common governance structure
- Accountable Care Organizations (ACOs) where participating providers share patient data for coordinated care and quality improvement
- Group health plans and their health insurance issuers
Joint Notice of Privacy Practices
One of the key benefits of OHCA status is the ability to issue a single, joint Notice of Privacy Practices (NPP). Rather than each covered entity within the arrangement preparing and distributing its own NPP, the OHCA may issue a single joint NPP on behalf of all participating entities. This joint NPP must describe the entities covered by the notice and their service locations, the PHI that will be shared among them, and the joint activities for which the PHI will be used.
The joint NPP simplifies the patient experience — patients receive one notice that describes how their information will be used across all the providers they see within the arrangement — and reduces the administrative burden on participating entities.
PHI Sharing Within an OHCA
Covered entities participating in an OHCA may share PHI with each other for joint healthcare activities — such as utilization review, quality assessment, and payment — without executing business associate agreements. The OHCA relationship itself authorizes this sharing. However, this permission is limited to the joint activities of the OHCA. Participating entities may not use PHI obtained through the OHCA for activities outside the arrangement without a proper legal basis.
Participation Requirements and Documentation
For an OHCA to be properly established, participating entities should document the arrangement in writing, identifying the participating covered entities, the scope of their joint activities, and their agreement to share a joint NPP where applicable. While HIPAA does not prescribe a specific form for this documentation, having written records of the OHCA's existence and membership is important for compliance purposes and is essential if OCR ever questions the basis for PHI sharing between the entities.
Each participating entity remains independently responsible for its own HIPAA compliance with respect to its individual activities outside the OHCA, and all entities must ensure that the shared NPP accurately reflects the actual practices of all participants.