A Business Associate Agreement Includes

For example, the contract must: describe the permitted and necessary use of the health information protected by the counterparty; provide that the counterparty does not use or disclose protected health information other than to the extent permitted, prescribed or prescribed by law; and request the counterparty to take appropriate security measures to prevent protected health information from being taken into account other than the contract or contract. Where a covered entity is aware of a breach or material breach of the contract or agreement by the counterparty, the covered entity shall be required to take appropriate measures to remedy the breach or to bring the breach to an end, and if those measures are unsuccessful to terminate the contract or agreement. If termination of the contract or agreement is not possible, a covered organization must report the issue to the Department of Health and Human Services `HHS) Office of Civil Rights (OCR). Please see our standard contract for business partners. (d) Counterparties may not use or disclose protected health information in a manner that would be contrary to Subsection E of 45 CFR Part 164 where the agreement allows the counterparty to use or offe (f) or (g) below, add “, except for the specific uses and advertisements listed below.”] Since the passage of the Health Information Technology for Economic and Clinical Health (HITECH) Act and its entry into HIPAA in 2013 through the HIPAA Omnibus Final Rule, subcontractors used by business partners are also required to comply with HIPAA. A counterparty must also obtain from its subcontractors a counterparty agreement SIGNED BY THE HIPC before having access to PHI or ePHI. If subcontractors use suppliers who need access to PHI or ePHI, they must also enter into counterparty agreements with their subcontractors. Where a counterparty/processor infringes or infringes a BAA, the covered entity must take appropriate measures to remedy the infringement or to bring the infringement to an end. “If such measures fail, they must terminate the contract or agreement,” HHS explains.