Can a service provider who provides HSA debit cards and other HSA administrative services be a business associate of a group health plan under HIPAA? Practically, the answer should be yes, but is the service provider providing payment or health care operations on behalf of the plan? I'm not so sure.

[CROSS POSTED TO HIPAA BOARD]