Jeff Lerner, HIPAA Compliance, and Business Associate Agreements When your organization uses data storage companies to store secure health information, they are considered a business associate. This can include hard-copy or digital data, as well as random and rare access, according to people like Jeff Lerner. A business associate agreement must include a risk analysis and disclosures required by HIPAA. For more information, see our article on the different types of business associate agreements. Here are some common types of business associate contracts. Hope, this article will be helpful. Jeff Lerner Suggested Resources https://twitter.com/JLernerReviews/status/1548144927443259393 https://twitter.com/JLernerReviews/status/1548874605959335936 https://twitter.com/JLernerReviews/media Covered Entities HIPAA applies to healthcare providers, clearing houses and their business associates. Providers include health insurers, doctors, dentists, chiropractors and psychologists. Clearinghouses are organizations that process non-standard health information for the purpose of providing health care. However, some types of business associates are not considered covered entities. For example, janitor services and electricians are not considered business associates. Large business associates often have their own legal and compliance departments. Lerner states that the main point of contact will usually be a representative of that department. However, some covered entities have a business person serving as the main point of contact. As a result, they will need to sign a Business Associate Agreement (BAA) with other health care providers. If so, the BAA should include provisions that require the business associate to pay certain costs associated with notifying the FDA. Many covered entities have electronic databases that track business associates, but a large percentage are not involved. Furthermore, the database may have the primary function of tracking vendor relationships, not business associates. Therefore compliance departments have considered purchasing software to manage business associates and ensure compliance with HIPAA. However, this approach can cause confusion as databases are not updated regularly. A third party certification process would reduce the burden on business associates and set a "gold standard" for covered entities. The BAA does not specify specific uses or disclosures that must be disclosed. While underlying service agreements often do, a BAA may be required to comply with HIPAA requirements. Furthermore, it is not clear whether a BAA should be mandatory for a business. Associates. Therefore, Covered Entities should make sure their business associates understand the BAAs. In addition, the BAA should be standardized, if possible. Business associates Most business associates have established training programs and reinforce these trainings with annual refresher courses. However, some may lack this sophistication. For example, a large business associate may not offer specific employee training, as some roles require a more in-depth knowledge of HIPAA. Small business associates may not offer formal training, but they can refer employees to materials developed by OCR. In general, Business Associates are becoming more sophisticated. The purpose of this article is to share best practices with Business Associates to ensure they comply with HIPAA regulations. Some CE representatives suggest setting up a third-party certification process for Business Associates to ensure they are meeting minimum HIPAA requirements. While this method is not yet fully accepted, it will at least ensure that BAs adhere to minimum standards. This process can reduce the number of requests for due diligence from covered entities. Furthermore, a third-party certification process would be a good way to help reduce the burden on business associates and create a "gold standard" for covered entities. Some business associates perform various functions, including billing, claims processing, and data analysis. Many of these business associates also provide benefits and practice management services. Some of these functions also fall within the realm of legal, accounting and insurance consultancy. The types of services offered by Business Associates also depend on their size. There are some that perform similar functions to larger entities, but have different characteristics. While some are not required by law to provide certain services, they can provide other valuable services. Smaller physician practices hiring Business Associates are often concerned about the extent of HIPAA compliance. In addition, they may be concerned about whether their downstream vendors understand their obligations under the privacy and security regulations. In addition to these concerns, some business associates are concerned about the lack of technical security measures. This is especially important because these minor practices may not have adequate security measures. In other words, they may not have an idea of the scope of their privacy and security regulations. HIPAA-required risk analysis Performing a HIPAA-required risk analysis is one of the most important elements of managing BAA. Without risk analysis, you may not be able to determine whether your business associates are up to standard. HIPAA regulations have changed the way covered entities evaluate BAs, and it is important that covered entities focus on this area of compliance before entering into any agreements. Here are some red flags to look for before signing a business associate agreement with a vendor. Large Business Associates report fewer challenges with HIPAA compliance than Small Business Associates. However, they report difficulty updating thousands of BAAs. If they could get rid of the BAA, the burden would be reduced and more resources could be devoted to "real" compliance. But this is not as easy as it sounds. Large business associates have the bargaining power to negotiate with the business associate. In the United States, most covered entities do not ask business associates to perform a HIPAA-required risk analysis. Despite these risks, OCR takes these violations seriously and has fined them. The most recent example of a large HIPAA breach involving 500 or more records was caused by the failure of a business associate to conduct a HIPAA risk analysis since 2013. The BAA itself may differ from the requirements of the HIPAA Safety Rule. While most covered entity models use the BAA that OCR has released, small business associates will rely on their business managers to coordinate with the covered entities. In addition, the standard BAA template tracks the HHS OCR BAA template, so a business associate may be expected to review and sign it. In general, however, the requirements for HIPAA-required risk analysis will be different for a small business than for a hospital system or data center. Disclosures under a business associate agreement The HIPAA Rules and the HITECH Act are largely similar, except that the HITECH Act links business associate liability to the uses and disclosures that are detailed in the agreements. Business associates are organizations that process or store PHI for a covered entity. However, this requirement only applies to individual health record vendors and certain data transmission vendors. If you want to ensure that your business associate is HIPAA compliant, you should review your current business associate agreement. A business associate contract should also address whether the third party entity is required to return or destroy protected health information. The business associate must have a contract that states that it must keep protected health information confidential, and must state that the third-party recipients are intended to obtain the information. In addition, a covered entity can terminate the contract if the business associate breaches a significant period of the contract. The preamble to the NPRM also states that a business associate contract may include any arrangement that makes it possible to disclose PHI. There are also specific types of business associate relationships. For example, a covered entity may have a business associate agreement with an attorney. In such a case, the attorney may disclose the protected health information to an expert witness who is not performing any tasks or activities for the covered entity. While this may sound like a violation of privacy, it is not the end of the world. If a covered entity wants to protect its customers from harm, they need to ensure that their business associates are complying with the Privacy Act. If your business associate contracts include conditions such as breach notification, you should make sure they include a clause that specifies when and how the business associate must notify the covered entity. Some business associates may not even become aware of the breach until a few days after the breach. Therefore, it is important that you include language regarding the time limit for infringement notices. In some cases, the business associate may not know that the breach occurred until several days after the breach occurred. Termination of a business associate's relationship If the covered entity decides to terminate the business relationship, the business associate must return or destroy all copies of the protected health information. The business associate can keep the information for 30 days, but must destroy it or return the covered entity after that period. A business associate should limit the use of protected health information to those uses that are necessary for the proper administration and management of the covered entity. If this period is not possible, the business relationship may end. It is important to understand what the "end of business associate" really means when dealing with a business associate. The term "business associate" covers both business entities and individuals who perform specific activities on behalf of another party. In addition, a business associate contract may contain provisions relating to reporting, notification and insurance. The contract should clearly state what the covered entity is responsible for and who is responsible for it. The termination of a business associate's relationship can be handled in a way that protects the interests of both parties. The best way to avoid the risk of termination is to choose your business associates carefully. Be sure to set expectations in the beginning, and choose your distribution channel members carefully. If you have any concerns, Jeff Lerner teaches us that we should focus on the positive aspects of a potential mate, and be sure to address any red flags. If you take the time to identify and document these issues from the outset, you will be happier with your new business associate. Before terminating a relationship with a business associate, consider HIPAA compliance requirements. If your business associate does not meet HIPAA requirements, you may be fined by regulators. Civil rights offices and the state attorney general can also take legal action. Terminating a relationship with a business associate can have many consequences. Lastly, it is important to maintain the integrity of the information.

Jeff Lerner, HIPAA Compliance, and Business Associate Agreements

When your organization uses data storage companies to store secure health information, they are considered a business associate. This can include hard-copy or digital data, as well as … Continue reading Jeff Lerner, HIPAA Compliance, and Business Associate Agreements

Storify Go