Business Associate Agreements: Time to Update

If you sponsor a group health plan that is subject to the HIPAA Privacy and Security Rules, it is time to review and potentially update your business associate agreements.

On Jan. 25, 2013, the Department of Health and Human Services (HHS) issued significant new guidance on the rules that govern protected health information (PHI) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), hereinafter referred to as “the Omnibus Rule.” The Omnibus rule requires group health plans and their business associates to make changes to business associate agreements.

The HITECH Act made many of the provisions of the Privacy and Security Rules directly applicable to business associates in the same way that they apply to covered entities. In implementing the HITECH Act, the Omnibus Rule expands the definition of business associate, applying the Privacy and Security Rules to agents and subcontractors of covered entities and business associates. The Omnibus Rule also expands potential liability for a group health plan and business associate for the actions of an agent.

Action Items
Business associate agreements may need to be amended to reflect the Omnibus Rule. To the extent not already amended, such agreements must now provide that business associates will do the following:

  1. Comply with the applicable provisions of the Privacy and Security rules;
  2. Report breaches of unsecured PHI to the covered entity;
  3. Comply with a health plan’s obligations under the Privacy Rule when acting on the group health plan’s behalf to satisfy them;
  4. Disclose PHI as necessary to satisfy a participant’s request for an electronic copy of PHI; and
  5. Provide PHI when required by HHS to facilitate investigation of the business associate.

Business associate agreements must also require the business associate to enter into an agreement with subcontractors of the business associate that create, receive, maintain, or transmit electronic PHI on behalf of the business associate that such such subcontractors will safeguard the information.

The Department of Health and Human Services has published sample business associate agreement language on its website.

Effective Date for Business Associate Contracts
Existing Contracts—Sept. 22, 2014: Business associate agreements that were in existence as of Jan. 25, 2013, that are compliant, and that are not revised or renegotiated between March 26, 2013 and Sept. 23, 2013, do not have to be revised to incorporate the new requirements until Sept. 23, 2014.

If a contract that exists on Jan. 25, 2013, is not otherwise compliant with HIPAA, a new contract must be adopted by Sept. 23, 2013.

New or Renegotiated Business Associate Contracts: Business associate agreements that are re-negotiated and revised, or newly entered into after March 26, 2013, must include the provisions required by the Omnibus Rule.

For a further discussion of the changes made by the Omnibus Rule, please see our related advisory.

Written by:

Published In:


DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Davis Wright Tremaine LLP | Attorney Advertising

Don't miss a thing! Build a custom news brief:

Read fresh new writing on compliance, cybersecurity, Dodd-Frank, whistleblowers, social media, hiring & firing, patent reform, the NLRB, Obamacare, the SEC…

…or whatever matters the most to you. Follow authors, firms, and topics on JD Supra.

Create your news brief now - it's free and easy »

All the intelligence you need, in one easy email:

Great! Your first step to building an email digest of JD Supra authors and topics. Log in with LinkedIn so we can start sending your digest...

Sign up for your custom alerts now, using LinkedIn ›

* With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name.