When you run a private medical practice, you’re invariably going to need services and vendors outside of your practice. What you need to know is that any person or organization that you hire to handle, use, distribute, or access protected health information is a Business Associate (BA) and that you need to have a Business Associate Agreement (BAA.)

You need to have a Business Associate Agreement in place before you share protected health information.

The goal behind the Business Associate Agreement is to acknowledge that both parties are obligated to follow federal HIPAA regulations and to protect both parties in the event of a breach.

According to HHS, the Business Associate Agreement must:

Describe the permitted and required protected health information uses by the Business Associate and /or their subcontractors
State that the Business Associate and their Subcontractors will not use or further disclose protected health information beyond what is permitted or required by the contract or as required by law;
And require the Business Associate and their Subcontractors to use appropriate safeguards to prevent inappropriate protected health information use or disclosure

A Business Associate Subcontractor is a person or entity to that the BA delegates to perform a function, activity or service.

Contractors and Confidentiality Agreements

Your employees, independent contractors who work exclusively for your company or a sole proprietor with other clients are not BAs. In this case your practice is solely responsible if someone breaches protected health information. One way to address this from a compliance perspective is to have your employees and independent contractors sign a confidentiality agreement. The confidentiality agreements should:

Clarify the type of information the agreement covers.
Describe what type of information cannot be copied, downloaded or modified. As an aside, this is a very common source of a HIPAA breach—when some piece of protected health information is downloaded onto a desktop because its “easier” to access but it’s not secured.
Address issues like not removing a laptop containing protected health information from your office
State information must be returned upon employer’s request
Disciplinary action for persons responsible for a breach of confidential information

Your Business Associate Agreement should be written so that it’s “evergreen,” meaning that it renews automatically and doesn’t require a new signature to remain valid.

While the business associate has the liability, you as the covered entity are still required to take reasonable steps to cure the breach or end the violation.

Download the Business Associate Security Questionnaire to help you do your due diligence in choosing a Business Associate.
If you'd like to hear more tips on how to start, run and grow your practice and related medical businesses, please sign up for my newsletter at https://www.thepracticebuildingmd.com.

And, be sure to join my FB group, The Private Medical Practice Academy.

Enroll in my course, How To Start Your Own Practice and get the step-by-step process for opening your doors.

Or join The Private Medical Practice Academy Membership for live group coaching, expert guest speakers and everything you need to know to start, grow and leverage your private practice.

Business Associate Agreements