HIPAA - Business Associate Contracts or Other Arrangements 164.314(a)(1)

Overview:
(i) The contract or other arrangement between the covered entity and its business associate required by § 164.308(b) must meet the requirements of paragraph (a)(2)(i) or (a)(2)(ii) of this section, as applicable.
(ii) A covered entity is not in compliance with the standards in § 164.502(e) and paragraph (a) of this section if the covered entity knew of a pattern of an activity or practice of the business associate that constituted a material breach or violation of the business associate's obligation under the contract or other arrangement, unless the covered entity took reasonable steps to cure the breach or end the violation, as applicable, and, if such steps were unsuccessful.
(A) Terminated the contract or arrangement, if feasible; or
(B) If termination is not feasible, reported the problem to the Secretary.

Action Items:
1) Obtain and review a sample of contracts between the covered entity and business associates. Evaluate and determine if the conracts meet the requirements outlined by paragraph (a)(2)(i) or (a)(2)(ii).
2) Interview relevant personnel to verify that contracts with associates who are not compliant are terminated or reported if termination is not possible.

Related Documents:
1) Business Associate Management Policy
2) Business Associate Contracts

Additional Guidance:
The Business Associate Contracts and Other Arrangements standard found at § 164.308(b)(1) requires a covered entity to have contracts or other arrangements with business associates that will have access to the covered entity’s electronic protected health information (EPHI). The standard, at § 164.314(a)(1), provides the specific criteria required for written contracts or other arrangements between a covered entity and its business associates. The actual language used to address the requirements can be tailored to the needs of each organization, as long as the requirements are addressed.

In general, a business associate is a person or entity other than a member of the covered entity’s workforce that performs functions or activities on the covered entity’s behalf, or provides specified services to the covered entity, that involve the use or disclosure of protected health information. A business associate may also be a covered entity.

For example, a health care clearinghouse may be a business associate and is also a covered entity under HIPAA. A software vendor may be a business associate as well; however, it is not, in that capacity, a covered entity. In both cases, the organizations could perform certain functions, activities or services on behalf of the covered entity and would therefore be business associates. (See 45 CFR § 160.103, for the definition of “business associate.”)