BAAs
What is a business associate agreement?
A business associate agreement, or BAA, is the written contract HIPAA requires when a vendor creates, receives, maintains or transmits protected health information for you. It's how you get satisfactory assurance that the vendor will protect it.
Your EHR, billing service and IT support are the obvious ones. Shredding, answering services and cloud storage are the ones people forget.
Who counts as a business associate
Under 45 CFR 160.103, a business associate creates, receives, maintains or transmits PHI on your behalf, for work like billing, claims processing or quality review. It also includes anyone providing legal, accounting, consulting, management, administrative or financial services that involve your PHI. A subcontractor that handles PHI for your business associate is one too.
Two groups aren't. Your own workforce isn't, and neither is another health care provider when you share PHI with them to treat a patient. Sending records to the hospital a patient is admitted to doesn't need a BAA.
The security and breach terms
The list below covers the Privacy Rule terms in 164.504(e). The Security Rule adds more in 164.314(a): the vendor must comply with the Security Rule for electronic PHI, make sure its subcontractors agree to the same, and report security incidents to you, including breaches.
On breaches, the rule sets an outer limit. A business associate must tell you without unreasonable delay and no later than 60 calendar days after it discovers a breach of unsecured PHI (45 CFR 164.410). Some BAAs set a shorter window.
What usually goes wrong
The BAA is on the vendor's paper and nobody read it. Check the reporting window, whether the vendor limits what it owes you after an incident, and whether it covers every service you buy from them.
It's old. A BAA signed many years ago may be missing the subcontractor and security incident terms required now.
It isn't connected to anything. The BAA is in one folder and the service agreement in another, so when the contract ends, nobody thinks about the PHI.
What to watch
Does it say what the vendor may do with PHI?
It must set the permitted and required uses and disclosures.
Does it require safeguards and reporting?
The vendor must use appropriate safeguards and report unauthorized uses, including breaches.
Does it require Security Rule compliance?
For electronic PHI, the BAA must require the vendor to comply with the Security Rule and report security incidents.
Does it cover the vendor's subcontractors?
They must agree to the same restrictions.
What happens at the end?
It must require returning or destroying PHI if feasible, and allow you to terminate for a material violation.
Does it support patient rights?
It must make information available for access, amendment and accounting of disclosures.
How Sapphires helps
- Each vendor shows a BAA on file, BAA terms inside the contract, or missing.
- A vendor marked as handling PHI stays flagged until a BAA is in place.
- When you upload a contract, Sapphires notes whether it contains BAA terms, for you to confirm.
- BAA statuses include Active, Pending, Expired and Refuse to Sign, so a vendor that won't sign stands out.
- Okeke LLC signs a BAA with each Sapphires customer too.
45 CFR 160.103: who is a business associate
45 CFR 164.502(e): disclosures to business associates
45 CFR 164.504(e): what a business associate contract must say
45 CFR 164.314(a): Security Rule terms for business associate contracts
45 CFR 164.410: breach notification by a business associate