Hipaa Baa Management

HIPAA Business Associate Agreement Management — §164.502(e), §164.504(e)

Overview

The HIPAA Privacy and Security Rules require covered entities to obtain satisfactory assurances from business associates that they will appropriately safeguard PHI. These assurances are documented through Business Associate Agreements (BAAs). The HITECH Act of 2009 and the 2013 Omnibus Rule fundamentally changed the BA landscape by making business associates directly liable for HIPAA Security Rule compliance and certain Privacy Rule provisions, and by extending the BAA chain to subcontractors. A BAA is not merely a contractual formality — it is a regulatory requirement, and failure to execute a BAA when required is itself a HIPAA violation subject to enforcement.

Who Is a Business Associate — §160.103

Definition

A business associate is a person or entity that:

1. On behalf of a covered entity or another business associate, creates, receives, maintains, or transmits PHI for a function or activity regulated by the HIPAA Administrative Simplification rules, including claims processing, data analysis, utilization review, quality assurance, billing, benefit management, practice management, and repricing; OR
2. Provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services to or for a covered entity where the provision of the service involves the disclosure of PHI

Who Is NOT a Business Associate

Common Business Associate Categories at Asclepius Health Network

Required BAA Provisions — §164.504(e)(2)

Mandatory Contract Terms

A BAA must include the following provisions:

1. Permitted and Required Uses and Disclosures

The BAA must establish the permitted and required uses and disclosures of PHI by the business associate. The BA may not use or disclose PHI other than as permitted or required by the BAA or as required by law.

Asclepius Health Network BAA language: "Business Associate shall not use or disclose Protected Health Information other than as permitted or required by this Agreement, as Required by Law, or as otherwise permitted by 45 CFR §164.504(e)."

2. Prohibition on Unauthorized Use or Disclosure

The BAA must not authorize the BA to use or disclose PHI in a manner that would violate the Privacy Rule if done by the covered entity.

Exception: The BAA may permit the BA to use PHI for:

• Proper management and administration of the BA
• Carrying out its legal responsibilities
• Data aggregation services (if specifically authorized)

3. Appropriate Safeguards

The BA must use appropriate safeguards and comply with the Security Rule to prevent unauthorized use or disclosure.

Asclepius Health Network BAA language: "Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI that it creates, receives, maintains, or transmits on behalf of Covered Entity, in accordance with 45 CFR Part 164, Subpart C."

4. Breach Reporting

The BA must report to the covered entity any use or disclosure of PHI not provided for by the BAA, including breaches of unsecured PHI as required by §164.410.

Asclepius Health Network BAA language: "Business Associate shall report to Covered Entity any use or disclosure of Protected Health Information not provided for by this Agreement of which Business Associate becomes aware, including any Breach of Unsecured Protected Health Information as required by 45 CFR §164.410, without unreasonable delay and in no case later than five (5) business days after discovery of the Breach."

5. Subcontractor Requirements

The BA must ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the BA agree to the same restrictions and conditions that apply to the BA, including entering into a BAA with the subcontractor.

6. Access Rights

The BA must make PHI available to the covered entity (or directly to the individual if designated in the BAA) to satisfy the individual's right of access under §164.524.

Asclepius Health Network BAA language: "Business Associate shall make available Protected Health Information in a Designated Record Set to Covered Entity, or at Covered Entity's direction, directly to the Individual, within fifteen (15) business days of a request, to satisfy Covered Entity's obligations under 45 CFR §164.524."

7. Amendment Rights

The BA must make PHI available for amendment and incorporate amendments as directed by the covered entity under §164.526.

8. Accounting of Disclosures

The BA must make available the information required to provide an accounting of disclosures under §164.528.

9. HHS Access

The BA must make its internal practices, books, and records relating to the use and disclosure of PHI available to HHS for determining compliance.

10. Return or Destruction of PHI

At termination of the BAA, the BA must return or destroy all PHI received from or created on behalf of the covered entity. If return or destruction is not feasible, the BA must extend the protections of the BAA for as long as it maintains the PHI.

Asclepius Health Network BAA Lifecycle Management