FAQs: Business associate agreements (BAAs)

A business associate agreement (BAA) outlines the responsibilities of both covered entities and business associates in handling protected health information (PHI). Its goal is to ensure compliance with HIPAA standards. A well-written BAA covers permissible uses and disclosures of PHI, security standards, breach reporting procedures, subcontracting arrangements, and termination clauses.

Read more: What is the purpose of a business associate agreement? 

FAQs about BAAs

1. What types of organizations need BAAs?

Cloud storage providers, billing companies, IT consultants, law firms, and marketing agencies are among the entities that need BAAs as they handle PHI on behalf of covered entities.

2. What information should be included in a BAA?

A BAA should define permitted PHI uses, security standards, breach procedures, subcontracting rules, and termination clauses.

3. Do standard BAA templates suffice?

While templates can be starting points, customization to address unique risks is important. Consulting a legal professional with HIPAA expertise is recommended.

4. How long should a BAA last?

BAAs should remain effective throughout the relationship and extend beyond PHI's data retention period.

5. What happens if a business associate breaches the BAA?

The BAA defines breach notification processes and potential consequences, including termination, corrective action plans, and financial penalties.

6. Who needs to sign the BAA?

Authorized representatives from the covered entity and the business associate should sign the BAA.

7. How often should BAAs be reviewed and updated?

Conducting reviews at least annually, especially with changes in regulations or services provided, is commonly recommended to ensure continued compliance.

8. Does a business associate need a BAA with every covered entity they work with?

Yes, each business associate needs a separate BAA with each covered entity.

9. Can business associates further disclose the PHI they receive?

No, business associates can only disclose PHI as permitted by the BAA and HIPAA regulations.

10. What documentation needs to be maintained regarding BAAs?

Covered entities should maintain copies of all signed BAAs and documentation related to their review and update history.

11. Can BAAs be verbal agreements?

No, BAAs must be written documents signed by both parties.

12. What are the consequences of not having a BAA?

Noncompliance with BAA requirements can lead to significant penalties, including HIPAA fines, reputational damage, and potential lawsuits.

13. Can a covered entity terminate a BAA if they're not satisfied with the business associate's security practices?

Yes, BAAs typically include termination clauses allowing either party to end the agreement under certain circumstances, including concerns about inadequate security practices.

14. Are there any resources available to help healthcare organizations understand BAAs?

Yes, the Department of Health and Human Services (HHS) provides various resources, including sample agreements, guidance documents, and FAQs. Industry associations and legal professionals specializing in healthcare law can also offer valuable assistance.

15. Can a BAA authorize marketing to patients using their PHI?

No, BAAs solely serve to protect patient privacy and security. Marketing activities require separate consent under HIPAA regulations.