BAA & HIPAA
If your organization qualifies as a “covered entity” under the Health Insurance Portability and Accountability Act (HIPAA), it is essential to establish business associate agreements with business associates and their subcontractors to ensure the proper protection of personal health information (PHI).
Business associate agreements are central to your organization’s HIPAA compliance program. These agreements detail permissible and impermissible uses of PHI, outline each party’s liabilities, and specify the consequences of non-compliance.
This article explores the importance of business associate agreements, why they are necessary, and how to create and manage them effectively.
What is a Business Associate Agreement?
A business associate agreement is a legally binding contract between HIPAA-covered entities and business associates to ensure full protection of PHI. This agreement is required if business associates or their subcontractors might access PHI during their work.
Not every business that handles PHI needs to create a business associate agreement. According to HIPAA, the following “covered entities” must establish these agreements:
- Health plans: Groups or individuals who pay for or provide medical care.
- Healthcare clearinghouses: Entities that process health information from another entity, such as billing services, community health information systems, and networks facilitating health information processing.
- Healthcare providers: Those who submit or transmit health information for transactions following HHS standards.
- Healthcare-related services: Including services, care, or supplies related to an individual’s health.
- Hybrid entities: Institutions like universities with academic medical centers and hospitals conducting electronic transactions that meet HHS standards.
Similarly, not every business partner of a HIPAA-covered entity is a business associate. Business associates include:
- Entities performing PHI-related activities or functions: Such as claims processing, data analysis, quality assurance reviews, and utilization reviews.
- Service providers: Entities performing actuarial, consulting, legal, data aggregation, accreditation, management, administration, or financial services involving PHI disclosure.
However, a covered entity’s employees, internet service providers, and courier service partners are not considered business associates.
Identifying Your Business Associates and Business Associate Subcontractors
Who Are Your Business Associates?
Understanding the classification of your workforce is essential for HIPAA compliance. Under the Health Information Portability and Accountability Act (HIPAA), a Business Associate is any individual or organization that collaborates with or provides services to a Covered Entity and, in doing so, creates, receives, maintains, or transmits Protected Health Information (PHI).
Potential Business Associates include:
- Accounting or consulting firms
- Cloud service providers
- Auditors and coding review consultants
- Legal firms
- Medical equipment service companies that handle PHI-storing devices
- Translation services
- Document shredding companies
- File-sharing service providers
- IT service vendors
According to the Department of Health and Human Services (HHS), Covered Entities can disclose PHI to Business Associates only to assist in healthcare operations, not for the Business Associate’s independent use. For instance, a Business Associate or Subcontractor cannot utilize PHI from a Covered Entity for their marketing purposes.
How to Create a Business Associate Agreement?
To create a business associate agreement, include the following components:
- Basic Information
- Date: Include a creation date at the top and a signing date next to each party’s signature.
- Names of the parties: Provide the full legal names of the parties involved. Specify which is the covered entity and which is the business associate.
- Acceptance: Determine how the parties will indicate acceptance of the terms, typically using traditional eSignatures.
- Business Associate Agreement-Specific Requirements
- Acknowledgment: Explain why HIPAA is relevant to the business relationship and why both parties are subject to HIPAA.
- Nature of the PHI involved: Specify what PHI the business associate and its subcontractors will access.
- Permissible vs. Impermissible uses: Define permissible and impermissible uses of PHI according to relevant laws and regulations.
- Liability and consequences: Include language that holds either party responsible for a PHI breach and outline consequences for failing to comply with HIPAA and contract requirements.
- Safeguards: Require the business associate to implement appropriate technical, physical, and administrative safeguards per HIPAA’s Security Rule.
- HIPAA training protocol: Establish a protocol for employee HIPAA training.
- Data breach procedure: Outline procedures in case of a data breach, including steps to mitigate harm.
- PHI return or destruction: Describe how parties should return or destroy PHI upon request.
How to Streamline Drafting and Managing Business Associate Agreements?
Creating and managing business associate agreements can be complex, especially if relying on traditional methods. Using modern Contract Lifecycle Management (CLM) managed services can centralize and streamline the process. With CLM services, you can:
- Draft, manage, and store contracts in a centralized Data Repository.
- Break down contract silos and streamline the process of answering questions about upcoming contractual obligations.
- Draft and approve automated workflows for business associate agreements.
- Modify contract template language, deliver updates instantly, and fine-tune approval routing workflows.
Consequences of PHI Disclosure by a Business Associate/Subcontractor
If a Business Associate or Subcontractor fails to comply with the terms of a Business Associate Agreement (BAA), the repercussions can be significant.
A Business Associate is directly liable under HIPAA Rules and can face civil and, in some cases, criminal penalties for unauthorized uses and disclosures of Protected Health Information (PHI) that are not permitted by the contract or required by law. Additionally, a Business Associate/Subcontractor is directly liable and subject to civil penalties for failing to safeguard electronic PHI under the HIPAA Security Rule.
In the event of a breach or violation of a BAA by a Business Associate/Subcontractor, the Covered Entity must take reasonable steps to remedy the breach or end the violation. If these steps are unsuccessful, the contract or arrangement must be terminated. If terminating the contract or agreement is not feasible, the Covered Entity is required to report the issue to the HHS Office for Civil Rights.
Business Associate Agreement Template
Click here to download a free Business Associate Agreement template provided by HHS.
Summary
Business associate agreements are crucial for HIPAA compliance if your organization is a covered entity. Healthcare providers, healthcare clearinghouses, and other HIPAA-covered entities must draft these agreements with business associates and subcontractors to protect PHI from potential breaches. Leveraging modern tools can simplify the creation and management of these critical agreements.
Legal Consulting Pro can significantly enhance the drafting and management of Business Associate Agreements through its comprehensive Contract Lifecycle Management (CLM) services. By leveraging Legal Consulting Pro’s advanced CLM expertise, organizations can streamline the entire contract process, from creation to execution. LCP offers services for drafting precise, compliant agreements, utilizing customizable templates that ensure all necessary HIPAA requirements are met.
Additionally, Legal Consulting Pro’s CLM services provide a centralized repository for storing and managing contracts, facilitating easy access and organization. Automated workflows and approval routing streamline the review and approval process, reducing administrative burden and ensuring timely compliance. With features like real-time updates and audit trails, Legal Consulting Pro helps organizations maintain a high standard of contract management, minimizing risks associated with PHI breaches and ensuring seamless, efficient operations.
