11-09-11 | Blog Post

What’s in a Business Associate Agreement?

Blog Posts

You’re a covered entity (your company processes, stores or transfers any type of patient information), and you’re outsourcing your HIPAA hosting services to a third party (an IT vendor, a billing company, etc.).

But before you can do that, you need to sign a business associate agreement (BAA) with your business associate (BA), according to the HIPAA Privacy Rule. But what’s in a business associate agreement contract?

The U.S. Department of Health and Human Resources (HHS) has a sample business associate contract available on its site listing all the provisions for those that are curious.

While this shouldn’t be copied precisely and is more of a guide than a complete document, it does offer insight into the general terms that a BAA should address, with the addition of customized provisions specific to certain companies’ needs.

A summary of the primary provisions include:

  • Obligations and Activities of Business Associate
    • No use or disclosure of protected health information (PHI) unless it’s permitted or required by law.
    • Must use proper safeguards to prevent use or disclosure of PHI.
    • Mitigation in the event of a data breach.
    • Must report any use or disclosure of PHI.
    • Ensures others (subcontractors) agree to the same BAA.
    • Allows CE access PHI.
    • Must create documented HIPAA policies and procedures.
    • Document any PHI disclosures.
  • Permitted Users and Disclosures by Business Associate
    • Specifies when BA can use or disclose PHI on behalf of the CE.
  • Specific Use and Disclosure Provisions (if applicable)
    • When or why a BA would disclose or use any PHI, to report law violations, with CE permission, or to provide any kind of data aggregation reports to the CE).
  • Obligations of Covered Entity
    • The CE will notify the BA of any changes in permission (including restrictions or revocation) of the individual to use or disclose PHI.
  • Permissible Requests by Covered Entity
    • Terms and effective dates
    • How PHI will be handled after termination (returned or destroyed)
    • Reasons for termination

If you’re a covered entity, protect your company and your patients/clients by signing a thorough BAA. As a best practice recommended for HIPAA compliance, it will only strengthen your ability to pass a HIPAA audit, should the auditors come to your door.

Business Associate Contracts

HIPAA Compliant Data CentersLooking for more information on HIPAA IT requirements, recommendations, and the foundation of a secure HIPAA compliant data center?
Download our HIPAA Compliant Hosting white paper now for a complete guide to HIPAA hosting with IT vendors.
Still have questions? Contact us now. Find out more about our fully compliant, HIPAA hosting solutions, or submit a quote request for your project today.

Overwhelmed by cloud chaos?
We’re cloud experts, so you don’t have to be.

© 2024 OTAVA® All Rights Reserved