Business Associates Agreement


[Parties may wish to add additional details as to how the counterparty responds to an access request that the counterparty receives directly from the person (e.g. B whether and to what extent a counterparty is to provide the requested access or if the counterparty transmits the person`s request to the entity concerned, in order to satisfy them) and the period within which the counterparty provided the information to the covered entity.] As health care becomes more complex and electronic records become more frequent, the Civil Rights Office (OCR), the HIPC`s executing authority, has recognized that counterparties need stricter rules. Since 2009, counterparties have been separately responsible for HIPC compliance – they can be monitored, reviewed and fined like covered companies. And with the passage of the Hi-Tech Law in 2013, the rules for business partners became explicit. This document contains examples of counterparty agreements that make it easier for companies and covered counterparties to meet counterparty contract requirements. While these examples of provisions have been drafted for the purposes of the contract between a classified entity and its counterparty, the language may be adapted for the purposes of the contract between a counterparty and a subcontractor. Transitional provisions for existing contracts. Covered companies (with the exception of small health plans) that entered into an existing contract (or other written agreement) with counterparty before October 15, 2002 may, under this contract, be permitted for up to an additional year regarding the compliance date of 14 Unless the contract is renewed or amended before April 14, 2003. 2003. This transitional period applies only to written contracts or other written agreements.

Oral contracts or other arrangements are not eligible for the transition period. Entities covered by eligible contracts may continue to operate under such contracts with their counterparties until April 14, 2004 or April 14, 2004 or until the renewal or amendment of the contract, whichever is earlier, whether or not the contract meets the applicable contractual requirements under 45 CFR 164.502(e) and 164.504(e). Otherwise, a data subject entity must comply with the data protection rule, for example.B. only make permitted advertisements towards the counterparty and allow individuals to exercise their rights in accordance with the rule. See 45 CFR 164.532 (d) and (e). [Option 2 – where the agreement authorises the counterparty to use or disclose protected health information for its own management and management or to exercise its legal responsibilities and the counterparty must retain protected health information for those purposes after termination of the contract] [In addition to other permitted purposes, the parties should indicate whether the counterparty has the right to use protected health information to identify the information referred to in CFR 164.514(a)-(c).

Pin It