Business Associate Agreements

The Private Medical Practice Academy

When you run a private medical practice, you’re invariably going to need services and vendors outside of your practice. What you need to know is that any person or organization that you hire to handle, use, distribute, or access protected health information is a Business Associate (BA) and that you need to have a Business Associate Agreement (BAA.)

You need to have a Business Associate Agreement in place before you share protected health information.

The goal behind the Business Associate Agreement is to acknowledge that both parties are obligated to follow federal HIPAA regulations and to protect both parties in the event of a breach.

According to HHS, the Business Associate Agreement must:

• Describe the permitted and required protected health information uses by the Business Associate and /or their subcontractors
• State that the Business Associate and their Subcontractors will not use or further disclose protected health information beyond what is permitted or required by the contract or as required by law;
• And require the Business Associate and their Subcontractors to use appropriate safeguards to prevent inappropriate protected health information use or disclosure

A Business Associate Subcontractor is a person or entity to that the BA delegates to perform a function, activity or service.

Contractors and Confidentiality Agreements

Your employees, independent contractors who work exclusively for your company or a sole proprietor with other clients are not BAs. In this case your practice is solely responsible if someone breaches protected health information. One way to address this from a compliance perspective is to have your employees and independent contractors sign a confidentiality agreement. The confidentiality agreements should:

• Clarify the type of information the agreement covers.
• Describe what type of information cannot be copied, downloaded or modified. As an aside, this is a very common source of a HIPAA breach—when some piece of protected health information is downloaded onto a desktop because its “easier” to access but it’s not secured.
• Address issues like not removing a laptop containing protected health information from your office
• State information must be returned upon employer’s request
• Disciplinary action for persons responsible for a breach of confidential information

Yo

Want to hear more tips on how to start, run and grow your practice and related medical businesses, please sign up for my newsletter at https://www.thepracticebuildingmd.com
Join my FB group, The Private Medical Practice Academy.
Enroll in How To Start Your Own Practice and get the step-by-step process for opening your practice.
Join The Private Medical Practice Academy Membership for live group coaching, expert guest speakers and everything you need to know to start, grow and leverage your private practice. The course, How To Start Your Own Practice is included in the membership, as a bonus.
Rate, Review, & Follow on Apple Podcasts"I love Sandy Weitz and The Private Medical Practice Academy Podcast." <-- If that sounds like you, please consider rating and reviewing my show! This helps me support more people -- just like you -- move toward the practice they want . Click here, scroll to the bottom, tap to rate with five stars, and select “Write a Review.” Then be sure to let me know what you loved most about the episode!