Hipaa Service Provider Agreement

10 Déc Hipaa Service Provider Agreement

For many covered companies, it is not always clear who is subject to a HIPAA business partnership agreement. The Department of Health and Human Services defines a counterparty as « a person or organization that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of a covered company or that provide services to a covered business. » Not all of these services need to manage your customers` information. However, some of them, like the . B an email provider like Hushmail, could at some point manage the PHI. If you are a covered entity, this PHI must be protected. The contract should provide that the BA (or subcontractor) must take appropriate administrative, technical and physical security measures to ensure the confidentiality, integrity and availability of ePHI and meet the requirements of the HIPAA security rule. Some of these measures may be indicated in the BAA or left to the BA`s discretion. The BAA should also include authorized uses and disclosures of PHI to meet the requirements of the HIPAA data protection rule. In case people who do not have access to the PHI for advertising information, such. B as the internal violation or cyberattack, access PHI, the business partner is required to inform the entity concerned of the violation and may be required to send notifications to persons whose PHI has been compromised. The timing and reporting responsibilities should be detailed in the agreement. The counterparty agreement is a contract that defines the types of protected health information (PHI) made available to the counterparty, the authorized uses and disclosures of PHI, the measures to be implemented to protect this information (for example.

B encryption at rest and during transmission), and the measures that the BA must take in the event of a security breach the PHI is available. The process of signing a BAA is very simple, although the details probably vary from provider to supplier. We take our process as an example. You need to be able to identify your employee classification before you know what HIPAA requires. Under the definition of the Health Information Portability and Accountability Act (HIPAA), a business partner is any organization or person that works in relation to a covered entity or provides services that generate, process or divid protected health information (PHI). The contract of a covered company or any other written agreement with its counterparty contains the elements covered in paragraph 45 CFR 164.504 (e). The contract must, for example. B Describe the authorized and necessary use of health information protected by the counterparty; provide that the counterparty will not continue to use or disclose protected health information, with the exception of the contract or the law; and require the counterpart to adopt appropriate security measures to prevent the use or disclosure of protected health information that is not provided for by the contract. If a covered entity is aware of a significant violation or violation by the counterparty of the contract or agreement, the covered entity is required to take appropriate steps to correct the violation or terminate the violation and if such measures are inconclusive, to terminate the contract or agreement.

If termination of the contract or agreement is not possible, a covered company is required to report the problem to the Department of Health and Human Services (HHS) Office for Civil Rights (OCR).