Are covered entities that engage in joint activities under an organized health care arrangement (OHCA) required to have business associate contracts with each other?

No. Covered entities that participate in an OHCA are permitted to share protected health information for the joint health care activities of the OHCA without entering into business associate contracts with each other. Of course, each such entity is independently required to observe its obligations under the HIPAA Privacy Rule with respect to protected health information.

October 2018