Failure to Have a Business Associate Agreement

The HIPAA Privacy Rule requires all covered companies to have a Business Partnership Agreement (BAA) signed with each Business Partner (BA) they hire that can connect with PHI. The OCR considers the agreement as a written assurance from the seller. By signing a contract, the supplier ensures that it has reported inappropriate disclosures to business partners. These cases raise another question: Under the HIPAA breach notification rule, does an affected company have to report inappropriate disclosure of PSR to a business partner itself if there is no BAA? Disclosure of PHI to a business partner without a BAA is a violation of the hipaa privacy rule, but not all violations of the privacy rules are reportable. A registered company does not need to report misuse, unauthorized access or improper disclosure if there is a low probability that the information has been compromised. See 45 CFR 164.402. In its commentary on the Omnibus Rule, HHS suggested that improper disclosure to another HIPAA entity that is otherwise required to maintain the confidentiality of information may indicate that there is a low probability that the data has been compromised. B for example if PHI is faxed to the fake doctor`s office. See 78 FR 5642. If so, disclosure to a business partner – who is required to maintain the confidentiality of the information, even if there is no written BAA – seems to indicate a low probability that the data has been compromised and, therefore, disclosure should not be reportable. Nevertheless, the companies covered should carefully analyze the facts of each case in light of the recent decisions of the OCR.

Failure to have HIPAA Business Partnership Agreements («BAAs») can result in significant penalties for healthcare providers and business partners. Last month, the OCR imposed a $500,000 settlement and a robust corrective action plan on a group of physicians who did not have a BAA with their billing company. After the billing company improperly granted access to protected health information on its website, OCR turned to the medical group to pay the price. (See www.hhs.gov/about/news/2018/12/04/florida-contractor-physicians-group-shares-protected-health-information-unknown-vendor-without.html). Become HIPAA compliant Attract new customers and grow your business. The following are generally not business partners, so no BAA is required. However, providers may want to enter into confidentiality agreements with them in the event that the individual accidentally accesses, uses, or discloses PSR: Since the passage of the Health Information Technology for Economic and Clinical Health Act (HITECH) and its inclusion in HIPAA in 2013 through the HIPAA Omnibus Final Rule, subcontractors used by business partners must also comply with HIPAA. A business partner must also obtain a HIPAA Business Partnership Agreement signed from its subcontractors before having access to PHI or ePHI. If subcontractors use suppliers who need access to PHI or ePHI, they must also enter into business partnership agreements with their subcontractors.

In addition to the regulations prescribed by HIPAA, a party may wish to add additional protections. For example, a covered legal entity may wish to include a indemnification provision to protect itself in the event that a business partner suffers a security breach affecting the relevant entity`s PSR. A HIPAA Business Partnership Agreement is a contract between a HIPAA-covered company and a supplier used by that covered company. A HIPAA entity is typically a healthcare provider, health care plan, or healthcare clearing house that conducts transactions electronically. A supplier of a HIPAA entity that must receive Protected Health Information (PHI) to perform tasks on behalf of the covered entity is called a Business Partner (BA) under HIPAA. A supplier is also classified as a ba if electronic PSR (ePHI) passes through its systems as part of the services provided. A signed HIPAA Business Partnership Agreement must be obtained from the relevant entity before a business partner can contact PHI or ePHI. Similarly, business partners must have a business partner subcontracting agreement with their after-sales service. The BA and BAS agreements are almost identical, so the main difference lies in the definition of the category. HIPAA`s requirement for covered companies to secure business partnership agreements is more than just a paper-to-check exercise. It is essential that organizations know to whom they are handing over PHI and have peace of mind that information is protected. There are many HIPAA models for trade partnership agreements, but caution should be exercised before using them.

Before using such a template, it is important to check for whom this template was designed to make sure it is relevant. It must also be customized to include all the requirements of the covered entity. If a business partner/processor violates or violates a BAA, the relevant entity must take reasonable steps to remedy the violation or terminate the violation. «If such steps don`t succeed, they have to terminate the contract or agreement,» HHS says. «If termination of the contract or agreement is not possible, a covered entity is required to report the issue to the HHS Office of Civil Rights.» 1 A «business partner» is a natural or legal person (with the exception of a member of the staff of a registered company) who performs certain functions or activities on behalf of a registered company or who provides it with certain services that include the business partner`s access to PSR. A «Business Partner» also includes a subcontractor who creates, receives, maintains or transfers PHI on behalf of another Business Partner. The functions and activities of business partners include: handling or managing complaints; data analysis, processing or management; Verification of use; quality assurance; Invoicing; performance management; practice management; and scaling. Services to business partners may include: legal; actuarial science; Accounting; Council; data aggregation; Management; medical, administrative transport; Accreditation; and financially. Admittedly, we do not know all the underlying facts that triggered ocR`s response; Either way, the cases serve as a sober warning that OCR can turn to affected companies to pay the price for their trading partner`s misconduct if there is no proper BAA. Perhaps the most important language that a BAA should contain in a language that indicates the process in the event of a violation.

Business partners must inform relevant companies in a timely manner of security-related security incidents or PSR-related breaches. For example, a BAA should include a statement such as: Contractors who work exclusively for your company, people with other customers, and employees hired through a company are not business partners. However, your company is liable if any of these people violate PSR. The contract must provide that the BA (or subcontractor) must put in place appropriate administrative, technical, and physical safeguards to ensure the confidentiality, integrity, and availability of ePHI and to comply with the requirements of the HIPAA security rule. Some of these measures may be provided for in the BAA or may be left to the discretion of the BA. The BAA should also include permitted uses and disclosures of PSRs to meet the requirements of the HIPAA Privacy Rule. In the event that persons who are not authorized to view the information gain access to PHI, e.B. an internal breach or cyberattack, the business partner is required to inform the relevant entity of the breach and possibly send notifications to persons whose PII has been compromised….