A business associate agreement is a contract between a healthcare provider and a third party that needs to access protected user data and resources. These third parties may perform different operations, such as medical billing, IT support, document shredding, or other types of service. These entities are considered business associates as we see with gurus like Jeff Lerner, and a business associate agreement functions similar to a non-disclosure agreement, with HIPAA obligations. Here are the most common scenarios in which a business associate agreement is appropriate.
HIPAA Business Associate Agreement
A HIPAA Business Associate Agreement is required if you plan to work with a contractor handling protected health information. These individuals aren’t employees, but they are considered business associates who are responsible for PHI. The agreement specifies the responsibilities and obligations of each party, reviews of Jeff Lerner say (source: https://www.youtube.com/watch?v=WXYWaCYWF74). Once signed, the BA is obligated to protect the PHI. The contract can be rolled into a data security agreement, master service agreement, or terms of service contract.
Lastly, your contract must contain a provision addressing the breach. You should note that this provision can be amended only in writing by the parties. Oral modifications will not be accepted. If you do find a breach, the Covered Entity must take immediate action to resolve the problem and terminate the contract. As we often see on the Facebook page of Jeff Lerner, in the event that the HIPAA Business Associate has violated this provision, you must report the breach immediately to HHS.
Before you sign a BAA, make sure your business associate is HIPAA compliant. If not, you can be fined by the Office of Civil Rights. Financial penalties range from $114 to $57,051, tied to the knowledge level of the offender. If you’re in doubt, seek legal advice. A qualified HIPAA attorney can help you with the contract. This can protect your patients’ PHI and ensure that your business associate is a reputable, reliable partner.
Your HIPAA Business Associate Agreement should clearly define the responsibilities and rights of the business associate. For example, if you’re in the business of providing healthcare services, you need to make sure that your business associate protects PHI. As we see when gurus like Jeff Lerner are discussed, this means they won’t be using PHI for marketing purposes unless you’ve granted permission from the Individual. If you’re in the business of marketing healthcare services, it’s imperative that you document this relationship in a document.
HIPAA Security Rule
A Business Associate must abide by the HIPAA Security Rule when handling patient PHI. It must implement appropriate safeguards, comply with individuals’ requests for copies of their PHI, make records available to HHS, and destroy or return PHI. Business associates must also abide by Electronic Transactions Rule, which limits disclosures to certain categories. This section is critical to the protection of personal health information. If any one of these areas is violated, the Covered Entity has the right to terminate the relationship.
Although Business Associates must follow the HIPAA Security Rule, smaller organizations often are ill-equipped to comply with HIPAA Security Rule requirements. Because business associates are required to return data immediately, many cloud storage vendors now consider themselves Business Associates. Larger Business Associates may feel the burden of maintaining compliance with HIPAA is too onerous, and they seek third-party audits for compliance. However, these larger Business Associates may be able to handle the workload without a great deal of headache.
Many Covered Entities have adopted the “better safe than sorry” approach and have executed agreements with all of their business associates. However, other Business Associates may have never had access to PHI. In these cases, an enforceable Business Associate Agreement may be necessary to protect patient PHI. A Business Associate agreement will help ensure compliance with the HIPAA Security Rule and ensure compliance. If a Business Associate does not meet its obligations under the agreement, it could be subject to a lawsuit by the Department of Health and Human Services, the Office for Civil Rights, and the Department of Justice.
While a Business Associate should be diligent in keeping PHI secure, this is not enough. A covered entity must also investigate suspected breaches and security incidents. The business associate must also make sure that its staff is aware of security breaches. In addition, it must notify affected individuals within five days of the security incident or breach. Businesses must also maintain confidentiality and privacy policies. There must be written agreements for employees and contractors and should also be signed between the two organizations.
HIPAA risk assessment
Before putting your company’s data into the hands of a business associate, it’s essential to conduct a HIPAA risk assessment. The information you provide them with is considered protected health information, and a breach of that information could result in hefty fines. However, not all insurers cover the costs of a HIPAA breach, including fines, hiring IT specialists, repairing public confidence in your practice, and credit monitoring services for patients. However, there are ways to limit your insurance coverage, and it’s important to understand HIPAA risk assessment before entering into any agreement with a business associate.
While most businesses are required to obtain an initial HIPAA risk assessment, few do it after signing a contract. Despite the fact that this information is crucial to protecting patients’ health, many businesses fail to perform a risk analysis of their business associate agreements. Instead, they simply accept the business associate’s terms and conditions without doing the proper research. A risk assessment is essential to protecting the privacy and security of patient information.
As a result, the need for HIPAA risk assessments has grown rapidly in recent years. While many large companies have dedicated resources to monitoring their Business Associates, small organizations don’t have that luxury. Even larger entities may have an insufficient staff to monitor every vendor, and this makes it difficult to conduct a comprehensive review of each and every partner. But if your company doesn’t have the resources to monitor your Business Associates, you can still use an HIPAA risk assessment tool.
Once a business associate has completed the risk assessment, it must notify the Covered Entity in writing that it will protect PHI in accordance with HIPAA rules. The Business Associate’s contract must also contain language specifying its commitment to the Privacy Rule. This means it must ensure that all contractors working on a business associate’s behalf must also comply with the HIPAA requirements. If a business associate fails to comply with HIPAA, then the covered entity can be held liable for the damages caused by the breach.
HIPAA incident reporting rules
One of the key things to be aware of is the HIPAA incident reporting rules for business associate agreements. This important rule states that covered entities must notify individuals, regulators, and the media if they become aware of a breach of protected health information. For breach notification to be effective, covered entities must follow the rules in writing, train employees, and enforce sanctions when employees fail to meet them. In addition, breach notification is also required if unsecured PHI was affected.
For example, a business associate that has a cloud computing platform may be considered a Business Associate. These vendors are also subject to the rules and must return all data within one day of the service. In this scenario, the Business Associate may not know that they have been breached until days later. However, in many cases, covered entities are attempting to include very short breach reporting windows in their contracts, so that the business associate may not be aware of the breach for days or even weeks later.
The Business Associate must notify the Covered Entity in writing of any breach or security incident within 60 days, without undue delay. The business associate should also require its subcontractors to follow the same restrictions as it. However, a breach must be reported to the HIPAA Security and Privacy Office as soon as possible. The Business Associate must also provide the Secretary with copies of internal practices, including all records and documents related to the Use and Disclosure of PHI.
A Business Associate must follow certain guidelines to ensure the security and privacy of PHI. For example, the Business Associate must not accept payment for PHI. The Business Associate must also not remunerate individuals for providing services. If a business associate agrees to remuneration, it should only do so after obtaining consent from the Covered Entity. If a business associate fails to follow these guidelines, it will be subject to civil liability for breach of terms and/or unauthorized Use and Disclosure of PHI.
Shared liability between a covered entity and a business associate
A business associate agreement is required for any entity with the potential to receive PHI from a covered entity. These entities include healthcare clearinghouses, repricing companies, billing services, and community health information systems. They may also include value-added switches for the processing of nonstandard formats. Under HIPAA, covered entities must maintain confidentiality and security of PHI and comply with its requirements.
A business associate is anyone who performs a function for a covered entity. This can include employees, contractors, consultants, and trainees. In other words, a Business Associate can be anyone who has direct control or is paid by the covered entity. By signing a Business Associate Agreement, a covered entity can avoid the requirements of HIPAA for those individuals. But if the covered entity itself is responsible for the activities of the business associate, it may not be liable for those services.
However, business associates have an interest in avoiding or significantly limiting indemnification obligations. Therefore, it is necessary to develop a compromise position between the two parties. For example, the parties will typically negotiate a cap on indemnification obligations. This cap may be tied to the amount of revenue paid under the underlying agreement. If this is not sufficient, the business associate may inherit the responsibility and face monetary penalties.
In general, a business associate agreement will track OCR model BAA guidelines and must be signed by both parties. While Business Associates are expected to sign a BAA, most Covered Entities have experienced little pushback from Business Associates regarding the standard required provisions of the BAA. On the other hand, gurus like Jeff Lerner have shown that many have experienced Business Associates that tried to negotiate additional provisions, often related to liability for mishandling PHI or indemnification of the covered entity.
