Office Of Civil Rights Business Associate Agreement
The most comprehensive source of information about HIPAA is the HHS website. However, since HHS cannot cover all possible relationships between a covered company and a counterparty, some of this information may be difficult to track and interpretable. For specific advice on specific circumstances, it is recommended to ask for professional hipaa compliance assistance. In August 2015, the HHS Office for Civil Rights (OCR) launched a compliance audit of the Centre for Children`s Health (CCDH) following an investigation by a business partner, FileFax, Inc., which recorded records containing protected health information (PHI) for the CCHR. While CCDH began notifying Filefax PHI in 2003, neither party was able to submit a Trade Association (BAA) agreement signed before October 12, 2015. A written contract between an insured entity and a counterparty must determine: 1) the use and disclosure of protected health information authorized and necessary by the counterparty; (2) provide that the counterparty will not use the information or disclose it any more than is authorized or necessary under the contract, or as required by law; (3) require the counterparty to put in place appropriate security measures to prevent the unauthorized use or disclosure of information, including the requirements for the implementation of the HIPAA security rule with respect to electronically protected health information; (4) require the counterparty to notify the entity concerned of the use or disclosure of information that is not included in its contract, including incidents that constitute violations of unsecured protected health information; (5) require the counterparty to disclose protected health information in accordance with its contract in order to comply with the obligation on a covered company to submit copies of their protected health information for individual requests for protected health data, as well as to provide protected health information for any modifications (and, if applicable, modifications) and accounting; (6) to the extent that the counterparty must meet the obligation of a company insured under the data protection rule, compel the counterparty to meet the requirements of the undertaking; (7) require HHS to provide its internal practices, books and records relating to the use and disclosure of protected health information obtained or established by the company bound by the company insured for HHS purposes, in order to determine compliance with the HIPAA data protection rule by the target company; (8) in the event of termination of the contract, where possible, require the consideration to return or destroy any protected health information received or created or received by the partner on behalf of the insured company; (9) require the counterparty to ensure that all subcontractors it can exercise on its behalf and have access to protected health information accept the same restrictions and conditions as those that apply to the counterpart with respect to that information; and (10) to authorize the termination of the contract by the covered entity if the consideration violates a significant clause of the contract. Contracts between counterparties and subcontractor counterparties are subject to the same requirements. [Option 2 – where the agreement authorizes the counterparty to use or disclose protected health information for its own management and administration, or to exercise its legal obligations, and the counterparty must retain protected health information for such purposes after the termination of the contract] General provision. The data protection rule requires that a covered entity receive satisfactory assurances from its counterparty that the counterparty adequately protects the protected health information it receives or creates on behalf of the entity concerned.