HIPPA and Self-Storage: Beware

By Richard Marmor, Esq.
AZSA Legal & Legislative Chair

HIPAA, aka the Health Information Portability and Accountability Act, is the law that protects the privacy of your health information. It compels your health care providers to pepper you with policy disclosures and those annoying forms you have to sign pretending that you understand who they will and won’t discuss your health information with.

Of course the reason that doctors foist all that paper on you is that they have basically signed their lives away pledging to protect your information and specifying what measures they will implement to do it. They take all this seriously because the fines for unauthorized leaks of the data can be staggering.

The law contemplates that there are going to be people beyond the obvious who are going to have access to your medical records behind the scenes, for example, a billing service that handles all of the doctor’s patient and insurance billings, health insurance companies and their layers of people, companies that turn hand-written medical records into digital data files, etc. They are all deemed by the law to be “HIPPA business associates.” And in order for them to be able to handle the records, they must sign “business associate agreements” in which, like the doctors, they sign their lives away pledging and certifying all the same things, and exposing themselves to the same staggering fines if data leaks from their control.

Notice that to be considered a HIPPA business associate, the person or organization is performing activities that involve the use of protected health information; i.e., they have reason to see and deal with medical records. Contrast that with the cleaning lady who sanitizes the doctor’s office each evening. She may actually pick up your file off of the doctor’s desk in order to dust underneath it taking momentary possession of your file. Yet, she is clearly not a HIPPA business associate, even if she inadvertently drops the file on the floor and in retrieving it sees your cholesterol level. She has no role in dealing with medical information. Likewise, the U.S. Postal Service may transport medical records, and although they have possession of them physically while in transit, they have no involvement with their contents, i.e., no reason to see and deal with medical information.

By now you are no doubt wondering what this all has to do with self-storage. Medical providers frequently rent space in which to store old records. In their zeal to make sure that HIPPA rules are being followed, they have been known to demand that the storage facility enter into a HIPPA business associate agreement with them. This clearly grows out of a misunderstanding of what a self-storage is.

We are landlords; we rent space. We are not bailees; that is, we do not take care, custody or control over tenants’ property. The AZSA standardized lease makes clear that no bailment exists. Your substandard lease should too (not so subtle hint, hint). This is true even when we cut a lock and sell a unit at auction. Arizona law provides: “Unless the rental agreement specifically provides otherwise and until a lien sale under this article, the exclusive care, custody and control of all personal property stored in the leased space remain vested in the occupant.” [A.R.S. §33-1704(L)] Self-storage is like the Post Office. We may end up with medical records at our site, but we have no reason to see and deal with their content.

So if you are ever asked by a potential medical tenant to sign a HIPPA business associate agreement as a condition of their renting space, under no circumstances sign it! You are not required by law to sign it, and doing so needlessly exposes you to fines and risks you would otherwise not be subject to. Explain to the potential renter what I have explained here, and that you are nothing more than a landlord, exempt under HIPPA. You might point out, too, that the landlord where they rent offices didn’t need to sign such an agreement, so why should you?

[This article deals with a law related subject at a general level and is not intended for you to rely on. You should consult a lawyer before making a final decision in a situation involving any legal issues.]

Richard Marmor, Esq. is a self-storage consultant, facility owner and former facility operator in the Phoenix area. He is also the founding President and current member of the Board of Directors of the Arizona Self-Storage Association, serving as Chair of the Legal and Legislative Committee.

Source: Behind Closed Doors, AZSA Newsletter Archives