INTRODUCTION TO BUSINESS ASSOCIATES

INTRODUCTION TO BUSINESS ASSOCIATES

 

The 2013 Omnibus Rule significantly expanded HIPAA’s reach by making business associates directly liable for HIPAA compliance.

Before 2013:

 

• Only covered entities were directly liable
• Business associates had obligations through contracts, but weren’t directly subject to HIPAA penalties

After 2013:

 

• Business associates are directly liable under HIPAA
• Both Security and Privacy Rules apply to business associates
• HHS can investigate and penalize business associates directly
• Both covered entities AND business associates can be held responsible for violations

Why This Matters:

 

Healthcare organizations work with dozens or hundreds of vendors and contractors. Each relationship involving PHI creates compliance obligations and potential liability. Understanding business associate relationships is critical to:

• Proper contract management
• Risk mitigation
• Regulatory compliance

• Protecting patient privacy

WHAT IS A BUSINESS ASSOCIATE?

 

Official Definition:

 

A person or entity that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of, or provides services to, a covered entity.

Key Elements:

 

1. **Person or Entity:**

• Companies
• Individuals
• Organizations

2. **Performs Functions/Activities:**

• On behalf of covered entity
• Involving use or disclosure of PHI

3. **Or Provides Services:**

• Creates, receives, maintains, or transmits PHI
• For or on behalf of covered entity

**Important:** The relationship, not the type of company, determines business associate status!

COMMON BUSINESS ASSOCIATE RELATIONSHIPS

 

Healthcare Operations Support:

 

• Medical billing companies
• Claims processing services
• Practice management companies
• Utilization review organizations
• Quality assurance companies
• Medical transcription services
• Patient safety organizations

Technology and IT Services:

 

• EHR/EMR vendors
• Cloud storage providers (if storing PHI)
• Data backup services
• IT support and managed services
• Software-as-a-Service (SaaS) providers with PHI access
• Email/communication platforms with PHI
• Data analytics companies

Professional Services:

 

• Legal counsel reviewing cases with PHI
• Accountants/auditors with access to PHI
• Consultants reviewing operations involving PHI
• Accreditation organizations
• Business consultants with PHI access

Administrative Services:

 

• Third-party administrators
• Benefits managers
• Collection agencies handling medical debt
• Document shredding/destruction services
• Off-site storage companies

Patient Services:

 

• Patient portal vendors
• Telehealth platforms
• Appointment scheduling services (third-party)
• Patient communication/reminder services
• Health information exchanges (HIEs)

Research and Analytics:

 

• Research organizations conducting studies with PHI
• Data analytics firms
• Pharmaceutical companies conducting research with covered entity data

Other Services:

 

• Medical equipment repair companies that may access PHI
• Lawyers representing covered entity in litigation involving PHI
• Health coaches or wellness vendors with PHI access

WHO IS NOT A BUSINESS ASSOCIATE?

 

Members of the Workforce:

 

Employees, volunteers, trainees, and others under direct control of the covered entity are NOT business associates – they’re workforce members.

Other Covered Entities:

 

When two covered entities share information for treatment, payment, or operations, they’re not business associates of each other.

**Example:** Hospital refers patient to specialist. They’re both covered entities sharing info for treatment – no BAA needed.

Conduit Exception:

 

Entities that merely transport PHI but don’t access it (other than on a random or infrequent basis) are not business associates.

Examples of Conduits:

 

• S. Postal Service
• UPS, FedEx (package delivery)
• Internet Service Providers (ISPs)
• Telephone companies

NOT Conduits (ARE Business Associates):

 

? Email hosting services (they can access email content)

? Cloud storage providers (they can access stored data)

? EHR vendors (they access and maintain data)

Personal Representatives:

 

Family members acting on behalf of patients are not business associates.

Patients Themselves:

 

Individual patients are never business associates even if you disclose PHI to them.

WHEN IS A BAA REQUIRED?

 

A Business Associate Agreement (BAA) is required BEFORE a business associate can create, receive, maintain, or transmit PHI on behalf of a covered entity.

Timing:

 

• BEFORE any PHI is shared
• Before services begin
• Before system access is granted

Red Flag:

 

If a vendor says “we don’t need a BAA” but they’ll have access to PHI – STOP! They either:

1. Don’t understand HIPAA (concerning!)

2. Are trying to avoid responsibility (very concerning!)

3. Genuinely don’t need one (rare – verify why)

When NOT Required:

 

1. **Workforce members** (covered by employer’s policies)

2. **Other covered entities** for TPO purposes

3. **Conduits** under the conduit exception

4. **Disclosures where entity only uses de-identified data** (no PHI involved)

REQUIRED PROVISIONS IN A BAA

 

The HIPAA Rules specify what MUST be in every Business Associate Agreement:

**1. PERMITTED AND REQUIRED USES AND DISCLOSURES**

 

The BAA must:

• Specify permitted uses and disclosures of PHI

• State that uses/disclosures must be consistent with covered entity’s notice of privacy practices
• Not authorize uses/disclosures that would violate HIPAA if done by covered entity

Example:

 

“Business Associate may use and disclose PHI only as necessary to perform medical billing services on behalf of Covered Entity and as permitted under this Agreement and the HIPAA Privacy Rule.”

—

**2. BUSINESS ASSOCIATE’S OBLIGATIONS**

 

The BA must agree to:

A.  Not Use or Disclose PHI Except as Permitted

 

• Only for purposes specified in agreement
• As required by law
• In compliance with HIPAA

B.  Use Appropriate Safeguards

 

• Implement administrative, physical, and technical safeguards
• Prevent use or disclosure except as permitted
• Comply with Security Rule for ePHI

C.  Report Security Incidents and Breaches

 

• Report any security incident (attempted or successful)
• Report breaches of unsecured PHI
• Report within timeframe specified (usually “without unreasonable delay”)

D.  Ensure Subcontractors Comply

 

• Obtain BAAs with any subcontractors
• Ensure subcontractors agree to same restrictions
• Be responsible for subcontractor compliance

E.  Make PHI Available to Individuals

 

• Provide access to PHI as needed for covered entity to meet patient access requests
• Within timeframes specified in Privacy Rule

• In format requested if readily producible

F.  Make PHI Available for Amendment

 

• Make PHI available for amendment as needed
• Incorporate amendments as directed by covered entity

G.  Make PHI Available for Accounting

 

• Provide information needed for accounting of disclosures
• Track disclosures made
• Respond to accounting requests

H.  Make Internal Practices Available

 

• Allow covered entity to inspect and review BA’s practices, books, and records
• Make available to HHS for compliance review
• Document HIPAA compliance

I.  Return or Destroy PHI at Termination

 

 

 

 

 

 

 

—

• Return or destroy all PHI when agreement ends
• Retain no copies
• If not feasible, extend protections and limit uses/disclosures

**3. COVERED ENTITY’S OBLIGATIONS**

 

The agreement should specify covered entity responsibilities:

—

• Provide notice of privacy practices
• Provide notice of restrictions patient has requested
• Provide notice of changes to permissions or restrictions
• Not request BA to use/disclose PHI in violation of HIPAA

**4. TERM AND TERMINATION**

 

A.  Term:

 

• Effective date

• Duration of agreement

B.  Termination for Cause:

 

• If BA violates material term
• If covered entity learns of pattern of activity that violates agreement
• Covered entity must:

1. Provide opportunity to cure, OR

2. Terminate agreement, OR

3. If neither feasible, report to HHS

C.  Effect of Termination:

 

• Return or destruction of PHI
• Survival of certain obligations
• No continued use or disclosure

D.  Obligations Upon Termination:

 

• BA returns or destroys all PHI
• BA retains no copies
• This applies to PHI in possession of subcontractors too

Exception:

 

If return or destruction is not feasible:

—

• BA extends protections
• Limits further uses/disclosures to purposes that make return/destruction infeasible
• Returns or destroys when feasible

5.  ADDITIONAL PROVISIONS (Recommended)

 

While not required by HIPAA, these are strongly recommended:

Liability and Indemnification:

 

• Who is liable for breaches
• Insurance requirements

• Indemnification provisions

Compliance Monitoring:

 

• Right to audit BA’s compliance
• Frequency of audits
• Remediation requirements

Breach Notification Details:

 

• Specific timeframes for notification
• Information to be provided
• Investigation requirements

Security Requirements:

 

• Specific safeguards required
• Encryption requirements
• Access control requirements
• Incident response procedures

Training:

 

• BA workforce training requirements
• Frequency of training
• Documentation requirements

Subcontractor Management:

 

• Approval process for subcontractors
• List of approved subcontractors
• Ongoing vendor management

SUBCONTRACTORS (Business Associate’s Business Associates)

The Rule:

 

If a business associate uses a subcontractor that will create, receive, maintain, or transmit PHI on the BA’s behalf, the BA must:

1. Obtain a written BAA with the subcontractor

2. Ensure subcontractor agrees to same restrictions and conditions that apply to BA

3. Remain responsible for subcontractor’s compliance

Example Chain:

 

**Covered Entity** (Hospital)

¯ [BAA Required]

**Business Associate** (Cloud EHR Vendor)

¯ [BAA Required]

**Subcontractor** (Cloud Infrastructure Provider)

¯ [BAA Required]

**Sub-Subcontractor** (Backup Service Provider) Each link in the chain requires a BAA!

Covered Entity Responsibilities:

 

• Know if BA uses subcontractors
• May require list of subcontractors in BAA
• May require approval before engaging new subcontractors
• Can conduct due diligence on subcontractors

Business Associate Responsibilities:

 

• Obtain BAAs with all subcontractors
• Monitor subcontractor compliance
• Responsible for subcontractor violations
• Report subcontractor breaches to covered entity

VENDOR MANAGEMENT AND DUE DILIGENCE

 

Before Engaging a Business Associate:

 

1. Assess Need and Risk

 

• Does this vendor really need access to PHI?
• Can services be provided without PHI?
• What is the risk level?

• How sensitive is the PHI they’ll access?

2.  Vendor Due Diligence

 

Ask potential vendors:

• Do you understand HIPAA requirements?
• What security measures do you have in place?
• Have you had any breaches?
• Do you have HIPAA compliance documentation?
• Do you conduct security audits?
• What happens if you’re acquired or go out of business?
• Where will our data be stored?
• Who will have access?
• Do you use subcontractors?

3.  Review Security Practices

 

Request information about:

• Encryption practices
• Access controls
• Employee training
• Incident response procedures
• Disaster recovery plans
• Physical security
• Audit controls

4.  Check References

 

• Talk to other healthcare organizations using the vendor
• Look for any breach history
• Check reputation and stability

5.  Negotiate BAA

 

• Don’t accept “standard” BAA without review
• Legal counsel review
• Ensure all required provisions included

• Add specific security requirements
• Clarify breach notification procedures
• Address liability and insurance

6.  Document Decision

 

 

 

 

 

 

 

 

 

—

• Why this vendor was selected
• Due diligence conducted
• Risk assessment
• BAA and associated documents

Ongoing Vendor Management:

 

1. Monitor Performance

 

• Regular check-ins
• Review service quality
• Monitor for security incidents

2.  Conduct Periodic Audits

 

• Review security practices
• Verify compliance with BAA
• Test controls

3.  Stay Informed

 

• Monitor for vendor breaches
• Stay aware of vendor changes (acquisitions, leadership, services)
• Review vendor’s annual SOC 2 or similar audits if available

4.  Update Agreements

 

• When HIPAA requirements change
• When services change
• When risks change
• Periodically review and update

5.  Incident Response

 

• Have process for BA to report incidents
• Conduct joint investigations when needed
• Coordinate breach response

6.  Termination Planning

 

• Have exit strategy
• Know how data will be returned/destroyed
• Plan for service continuity
• Document data destruction

COMMON BAA PITFALLS AND MISTAKES

 

1.  No BAA in Place

 

Most common violation! Services begin before BAA is signed.

**Solution:** Make BAA a prerequisite for system access or PHI sharing.

—

2.  Outdated BAA

 

BAA doesn’t reflect 2013 Omnibus Rule changes.

**Solution:** Review and update all BAAs to ensure current compliance.

—

3. Missing Business Associate Relationships Not identifying all vendors who access PHI. Examples Often Missed:
   • Email hosting providers
   • Phone system vendors (with voicemail)
   • Copier lease companies (copiers store documents)
   • IT support contractors
   • Shredding companies
   • Attorneys who review medical records

**Solution:** Conduct thorough inventory of ALL vendors and assess each for BA status.

—

4.  Relying on “Standard” BAAs

 

Accepting vendor’s standard BAA without review.

Problems:

 

• May not include all required provisions
• May be one-sided (protects vendor, not you)
• May not address specific risks

**Solution:** Have legal counsel review all BAAs.

—

5.  No Subcontractor Visibility

 

Not knowing if/when BAs use subcontractors.

**Solution:** Require BA to list subcontractors and get approval before engaging new ones.

—

6.  No Monitoring or Auditing

 

Sign BAA and never verify compliance.

**Solution:** Include audit rights in BAA and exercise them periodically.

—

7.  Unclear Breach Notification Terms

 

BAA doesn’t specify timeframes or processes for breach notification.

**Solution:** Add specific breach notification procedures to BAA.

—

8.  No Termination Planning

 

Agreement ends but PHI isn’t returned or destroyed.

**Solution:** Clear termination and data return/destruction procedures in BAA.

—

9.  Cloud Service Confusion

 

Assuming cloud providers don’t need BAAs.

**Reality:** Most cloud providers ARE business associates if they can access PHI.

**Solution:** Understand cloud provider’s access to data and get BAA if needed.

—

10.  Missing Insurance Requirements

 

BA has no cyber liability insurance.

**Solution:** Require appropriate insurance coverage in BAA.

CLOUD SERVICES AND SAAS VENDORS

 

Special Considerations for Cloud/SaaS:

 

Is My Cloud Provider a Business Associate?

 

Ask:

• Can the provider access our PHI?
• Does the provider store our PHI?
• Could the provider’s employees view PHI?

If YES to any -> Business Associate

Common Misunderstandings:

 

**MYTH:** “It’s encrypted, so they’re not a BA.”

**FACT:** If they hold the encryption keys and could decrypt, they’re still a BA.

**MYTH:** “They just store it, they don’t look at it.”

**FACT:** If they CAN access it (even if they promise not to), they’re a BA.

**MYTH:** “Their terms of service say they’re not a BA.”

**FACT:** HIPAA definitions apply regardless of what vendor calls themselves.

BAA Requirements for Cloud Services:

 

Must address:

• Where data is stored (including backups)
• Who has access
• How data is encrypted (at rest and in transit)
• How data is backed up
• What happens if vendor is acquired
• How data is returned/destroyed at termination
• Incident response procedures
• Compliance with Security Rule
• Subcontractor disclosure

Red Flags:

 

[!] “We’re not a business associate” [!] “We can’t sign a BAA”

[!] “Our terms of service cover this” [!] “We’re just a conduit”

[!] “No one has ever asked us for this before”

If you hear these from a cloud vendor who will access PHI -> WALK AWAY or get legal counsel involved!

Major Cloud Providers:

 

Most major providers (AWS, Microsoft Azure, Google Cloud) understand HIPAA and will sign BAAs, but YOU must:

• Configure services securely
• Use appropriate service levels
• Enable encryption
• Manage access properly

The BAA doesn’t make you automatically compliant – you still have to implement proper security!

COVERED ENTITY RESPONSIBILITIES

 

Having a BAA doesn’t eliminate covered entity responsibilities:

1.  Due Diligence

 

• Vet vendors before engaging
• Assess security practices
• Verify HIPAA understanding

2.  Contract Management

 

• Ensure BAA is in place BEFORE PHI sharing
• Keep BAAs current
• Store BAAs securely

3.  Monitoring

 

• Review BA compliance periodically
• Audit when appropriate
• Respond to identified issues

4.  Minimum Necessary

 

• Only share PHI actually needed
• Limit BA access to minimum necessary
• Don’t grant blanket access

5.  Breach Response

 

• Coordinate with BA on investigations
• Ultimately responsible for breach notification (in most cases)
• Implement corrective actions

6.  Training Your Staff

 

• Train staff on when to engage BAs
• Ensure staff knows what can/cannot be shared
• Provide guidance on vendor selection

7.  Documentation

 

• Maintain inventory of BAs

• Document due diligence
• Track BAA status
• Record audit results

BUSINESS ASSOCIATE RESPONSIBILITIES

 

Business Associates are directly liable under HIPAA for:

 

1. Compliance with Privacy Rule

 

• Only use/disclose PHI as permitted
• Implement minimum necessary
• Honor patient rights (access, amendment, accounting)

2.  Compliance with Security Rule

 

• Implement administrative, physical, technical safeguards
• Conduct risk assessments
• Have security policies and procedures
• Training for workforce
• Incident response

3.  Breach Notification

 

• Discover and investigate breaches
• Notify covered entity within 60 days
• Provide information for covered entity’s breach notification
• May notify individuals directly if specified in BAA

4.  Subcontractor Management

 

• Obtain BAAs with subcontractors
• Ensure subcontractor compliance
• Responsible for subcontractor violations

5.  Cooperation with Covered Entity

 

• Provide access to information as needed
• Respond to audit requests
• Cooperate with investigations

6.  Cooperation with HHS

 

• Make practices, books, records available to HHS
• Respond to HHS investigations
• Comply with compliance reviews

ENFORCEMENT AND PENALTIES

 

Both covered entities AND business associates can be penalized for: Covered Entity Violations:

• Failing to have BAA with business associate
• Sharing PHI with BA without BAA
• Inadequate vendor oversight
• Failing to act when learning of BA violations

Business Associate Violations:

 

• HIPAA Privacy Rule violations
• HIPAA Security Rule violations
• Breach notification failures
• Failing to have BAA with subcontractors

Recent Enforcement Examples:

 

Case 1: Business Associate with Inadequate Security

 

Medical records management company had poor security. Hacking resulted in breach of 3.9 million patient records.

Penalty: $2.5 million settlement (against the BA, not the covered entities!)

Case 2: Covered Entity Failed to Have BAAs

 

Hospital engaged multiple vendors who accessed PHI but never obtained BAAs. Penalty: $2.15 million settlement

Case 3: Cloud Storage Provider Breach

 

Cloud backup service had breach. Multiple covered entity customers affected. Investigation found:

• No BAAs in place for some customers
• Inadequate security by BA
• Poor vendor oversight by covered entities Penalties: Both BAs and covered entities

BEST PRACTICES

 

For Covered Entities:

 

• Maintain comprehensive vendor inventory
• Assess each vendor for BA status
• Obtain BAAs BEFORE PHI sharing
• Conduct vendor due diligence
• Review and update BAAs regularly
• Exercise audit rights
• Monitor for vendor breaches
• Have termination and data destruction procedures
• Train staff on BA requirements
• Document everything

For Business Associates:

 

• Understand you’re directly liable under HIPAA
• Implement comprehensive compliance program
• Train your workforce
• Have written policies and procedures
• Conduct risk assessments
• Implement appropriate safeguards
• Obtain BAAs with all subcontractors
• Monitor subcontractor compliance
• Have incident response procedures
• Cooperate with covered entities
• Document compliance efforts

For Both:

 

• Take HIPAA seriously
• Invest in security
• Maintain open communication
• Work together on compliance
• Respond quickly to incidents
• Learn from mistakes
• Stay current on HIPAA changes

KEY TAKEAWAYS

 

• Business associates are directly liable under HIPAA (since 2013 Omnibus Rule)
• A BAA is required before any PHI can be shared with a business associate
• Common business associates include billing companies, EHR vendors, cloud providers, and many others
• BAAs must include specific required provisions per HIPAA regulations
• Business associates must obtain BAAs with their subcontractors
• Covered entities must conduct due diligence and monitor business associates
• Cloud/SaaS providers who can access PHI are business associates
• Both covered entities and business associates can be penalized for violations
• Vendor management is an ongoing process, not a one-time event
• “Standard” BAAs should always be reviewed by legal counsel