Health Information Compliance Alert

Question: Our clinic is reviewing all our business associates (BAs) and associated BA agreements (BAA). What should we do to ensure that we’re handling BAs and our arrangements with them appropriately?

Answer: The HHS Office for Civil Rights (OCR) is continuing to focus on BAs and BAAs, particularly during the Phase II HIPAA audits, according to a recent report by attorney Kate Stewart for the law firm Mintz Levin P.C. As you inventory your BAs, make sure that you:

• Have a single repository with a list of all your BAs and your BAAs.
• Have appropriate contracting practices in place to evaluate whether new arrangements require a BAA and to ensure legal review of BAAs that another party drafted. “When using your own template BAA, ensure that it appropriately reflects the relationship between the parties and the type of services being provided,” Stewart recommended.
• Do your diligence when entering into a BA relationship with a vendor.