What is a Business Associate Agreement?
A business associate agreement, often abbreviated to BAA, is a legally binding contract used in the healthcare industry. BAAs were established under the Health Insurance Portability and Accountability Act (HIPAA) and are used to formalize the relationship between a covered entity, like a healthcare provider, and a business associate, like a vendor.
The business associate agreement outlines the specific responsibilities and requirements that the business associate must adhere to in order to protect and secure the protected health information of patients. The purpose of this contract is to ensure compliance with HIPAA regulations and maintain the privacy and security of personal health information.
See Business Associate Agreement Pricing by State
- Alabama
- Alaska
- Arizona
- Arkansas
- California
- Colorado
- Connecticut
- Delaware
- District of Columbia
- Florida
- Georgia
- Hawaii
- Idaho
- Illinois
- Indiana
- Iowa
- Kansas
- Kentucky
- Louisiana
- Maine
- Maryland
- Massachusetts
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nebraska
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- New York
- North Carolina
- North Dakota
- Ohio
- Oklahoma
- Oregon
- Pennsylvania
- Rhode Island
- South Carolina
- South Dakota
- Tennessee
- Texas
- Utah
- Vermont
- Virginia
- Washington
- West Virginia
- Wisconsin
- Wyoming
How Do I Review a Business Associate Agreement?
Reviewing a business associate agreement is a crucial step for any organization in the healthcare industry that deals with protected health information.
To effectively review a business associate agreement, follow these steps:
- Obtain a copy and read the entire contract. Typically, the covered entity like a healthcare provider will provide the BAA to the business associate. Ensure that you have the most up-to-date version of the agreement and take your time reading the entire document.
- Review HIPAA compliance obligations. Carefully review the sections that outline each party's obligations regarding personal health information security, privacy, and compliance with HIPAA rules.
- Check for termination provisions. Review the BAA for termination clauses and understand the conditions under which the agreement can be terminated.
- Clarify dispute resolution procedures. The BAA should outline the procedures for dispute resolution which could involve mediation, arbitration, or litigation.
- Seek advice from a lawyer. If you are unsure about any aspect of the business associate agreement or have concerns about its terms, it's advisable to seek legal counsel familiar with the healthcare industry and HIPAA compliance.
What Should Be Included in a Business Associate Agreement?
A comprehensive business associate agreement should contain the following information and provisions:
- Parties. The identities of all parties involved and clear designation of the covered entity and the business associate by name and contact information.
- Scope of the agreement. A description of the services or functions the business associate will perform on behalf of the covered entity that involve the use or disclosure of personal health information.
- HIPAA compliance obligations. The BAA should outline the specific HIPAA compliance obligations of both the covered entity and the business associate. Obligations can include the business associate’s obligation to use and disclose personal health information only as permitted by the agreement and HIPAA regulations.
- Security measures. Detail the security measures and safeguards that the business associate will implement to protect personal health information. Common security measures include data encryption, access controls, and risk assessments.
- Privacy practices. How the business associate will maintain privacy when handling personal health information. Methods could include limiting personal health information use and disclosure to the minimum necessary.
- Reporting and breach notification. The procedures for reporting security incidents and breaches of personal health information including the timeframe for reporting, the method of reporting, and notification to the affected individuals.
- Indemnification and liability. Each party's financial responsibilities in case of a breach or violation.
- Termination provisions. The conditions under which either party can terminate the agreement and the required notice period for termination.
- Dispute Resolution. The procedures for dispute resolution in case disagreements arise between the covered entity and the business associate.
- Governing law. The governing law that will apply in case of legal disputes related to the BAA.
- Signatures and effective date. The BAA must be signed and dated by authorized representatives of both the covered entity and the business associate.
180 projects on CC
How Long is a Business Associate Agreement Good For?
Under HIPAA, there is no specific duration for the validity of a business associate agreement. However, several factors can influence how long a BAA should remain in effect.
- Duration of services. The primary factor that affects the duration of a BAA is the length of time the business associate will be providing services to the covered entity. The BAA should remain in effect for the duration of the services being provided.
- Retention of personal health information. The BAA should continue to be in effect if the business associate retains personal health information records, even if the business associate is no longer working with the covered entity.
- Regulatory compliance. HIPAA regulations are subject to change and the covered entity and business associate must maintain compliance. If there are updates to HIPAA rules during the term of the BAA, the agreement needs to be amended to follow HIPAA law.
- Business relationship changes. If there are significant changes in the business relationship between the covered entity and the business associate, like modifications to the scope of services, the parties may need to amend or extend the duration of the BAA.
- State and local laws. Some state and local laws may have regulations governing BAAs and the duration of the agreement. It is important that your business associate agreement complies with all applicable state and local regulations.
The duration of a business associate agreement can vary based on the specific terms outlined in the agreement, the type of services provided by the business associate, and the retention of personal health information.
If you are unsure how long your business associate agreement is good for or what the local laws and regulations dictate, you should contact a knowledgeable attorney. An attorney who specializes in business associate agreements will be familiar with applicable HIPAA requirements and laws to ensure that your business associate agreement is still in effect.
Should I Hire an Attorney to Review My Business Associate Agreement?
Yes. It is highly recommended that you hire an attorney to review your business associate agreement. BAAs are complex legal contracts that must adhere to HIPAA laws and regulations. It is essential that this document is up to date on current laws to protect both parties when dealing with personal health information.
Hiring a lawyer to review a business associate agreement provides the following advantages:
- Legal expertise. A lawyer familiar with BAAs will have specialized knowledge of healthcare laws like HIPAA standards and laws governing personal health information. This legal expertise is essential to ensure the contract complies with all applicable laws.
- Mitigating risks. BAAs often involve handling sensitive healthcare data. An attorney can help identify potential risks in the agreement and advise on ways to mitigate them. This can be crucial in protecting your interests and reputation.
- Negotiation/customization. If the BAA needs negotiation or customization to better align with your business needs, an attorney can help you negotiate terms that protect your interests.
While legal services can be expensive up front, they can also save you money in the long run by preventing legal disputes or regulatory fines. Hiring a lawyer to review your business associate agreement will ensure that your contract is legally binding, enforceable, and protects your interests
Get Help with Hiring an Attorney
Do you need help with a business associate agreement review? If so, post a project in ContractCounsel's marketplace to receive bids from lawyers who are licensed to practice law in your state and can handle your project. All lawyers on the ContractsCounsel's platform are vetted by our team to make sure you are provided with top-tier service.
