Free HIPAA Business Associate Template – Sample

With the increasing growth of technology and digitization in the medical facilities, the quality of healthcare delivery has significantly improved. Nowadays, medical services are not only fast but also efficient. However, besides the many benefits experienced in the sector, there are some disadvantages that have come along. For instance, the medical data are at risk of facing dangers such as targeted attacks, virus infiltration, employee misconduct, hacking, to mention a few. In an attempt to reduce the likelihood of such incidences, hospital organizations are urged to ensure the security of their data assets when doing any partnership or entering a contract with a third-party organization. The surest way of making such agreement formal is through a business associate (HIPAA) agreement.

A ‘business associate’ in simple terms refers to a third party who is involved in undertaking certain activities on behalf of a protected entity that is associated with protected health information (PHI). The protected entity usually includes a healthcare provider, a healthcare clearinghouse, or a health plan. Oftentimes, the entity should maintain full compliance with the Health Insurance Portability and Accountability Act (HIPAA) guidelines. As a subcontractor, the business associate will require some electronic PHI to pass through their system in order to execute their duties as recommended. In the process, they will be handling sensitive and confidential information that shouldn’t be disclosed to any other unauthorized party whatsoever. As such, complying with HIPAA regulations means safeguarding all the shared PHI with specific instructions. At no time will the business associate allowed to sell any prohibited health information or using it for other self-interest reasons.

Writing a Business Associate Agreement isn’t as easy as it may seem. Therefore, in order to make everything flowing for you, please download our free templates on this page. The templates are available in various formats, such as PDF, Microsoft Word, and ODT files. Besides, the templates flexible and can be edited to suit your preference.

Business Associate Agreement HIPAA

HIPAA Business Associate Agreement Standard Form

Literally, any organization that is involved in the sharing of PHI or the electronic PHI needs to sign a Business Associate Agreement before engaging any other party. Therefore, if you are operating in the following fields, know that your organization needs a Business Associate Agreement more than ever.

• Medical billing services
• Practice management
• Accountants
• Electronic healthcare providers
• Information and technology providers
• Shredding services
• Cloud storage providers
• Hospital supplies and management.

Insisting that every contractor sign the agreement

There are some covered organizations that go overboard by approaching every business relationship they engage with strict adherence to BAA. For instance, they make every contractor sign the agreement regardless of the services provided. Usually, there are some contractors that aren’t accessed to PHI, and therefore doesn’t need to sign the agreement. Therefore, if you insist on such contractors to sign the agreement, it would affect the relationship between you two.

Assuming that a signed BAA means compliance with HIPAA

Well, according to research by California Healthcare Foundation, it was noted that some covered entities were neglecting their responsibilities and obligations, claiming that after signing a Business Associate Agreement, they were already in compliance with the HIPAA. Unfortunately, this is not the case. Even after signing a BAA, it is equally important that every party observe compliance through effective protection of PHI.

Not having a HIPAA Business Associate Agreement for those entities accessed to ePHI

There are other entities that are not given Public Health Information while performing their task. However, the electronic PHI performs through its system. In that sense, they too should be made to sign the BAA as they risk disclosing them to the public.

Identifying the Business Associate Agreement and reviewing BA Relationship

All health care providers are expected to seek professional help from any other knowledgeable third parties. This will help protect their phi from violators or vandalism. Also, a knowledgeable third party will help in signing the BAA without any incompetency or hassles. For instance, the healthcare provider can contact a lawyer who practices healthcare IT and security space and understands the HIPAA protocols and guidelines. Through this, you will establish a working and effective agreement as well as understand the nature of the relationship.

• When the party or organization is not involved in the use or disclosure of the private and protected health information. Such as janitorial or electrical service providers.
• When a covered entity that participates in an organized health care arrangement (OHCA) is involved.
• When a covered entity purchases a health plan product such as insurance.
• When phi is disclosed to a research facility with patient authorization or pursuant to a waiver.
• When a person or an organization acts merely as a conduit for the PHI.

• Every entity associate with the creation, maintenance, and transfer of Protected Health Information (PHI) or ePHI must sign a Business Associate Agreement that is compliant with HIPAA.
• The Business Associate Agreement should be signed before disclosing the PHI to the Business Associate
• Both the Business Associate and the covered entity should take stringent precautions to protect the disclosure of the confidential PHI from unauthorized persons.
• If one party violates or breaches the Business Associate Agreement, the consequences can be costly.