A BAA is used when fully identifiable PHI is being shared with another party.
A Business Associate is a person or entity who performs functions or activities on behalf of, or provides certain services to, a covered entity (CE) (i.e. the University) that involve access by the BA to protected health information.
A "business associate" also is a subcontractor that creates, receives, maintains, or transmits protected health information on behalf of another business associate. A CE may be a BA of another CE if it performs such services for the other CE.
The HIPAA Rules generally require that CEs and BAs enter into contracts with their BAs to ensure that the BAs will appropriately safeguard PHI. The BAA also serves to clarify and limit, as appropriate, the permissible uses and disclosures of PHI by the BA, based on the relationship between the parties and the activities or services being performed by the BA. A BA is directly liable under the HIPAA Rules for making uses or disclosures of PHI not authorized by the BAA or required by law.
The following items must be addressed in the BAA to ensure compliance with current regulation:
Safeguards for protecting PHI
Reporting mechanism for inappropriate use/disclosure of PHI
Pass-through of provisions to any agent/subcontractor
Access to PHI for amendment and mechanism for Accounting of Disclosures (AOD)
Provision stating that BA will make available its internal practices, books and records relating to the use and disclosure of PHI for audit by HHS
Plan for return/destruction of PHI and termination of underlying agreement
The University’s BAA template fulfills all regulatory requirements.