Pursuant to the HIPAA Final Omnibus Rule (“Final Rule”), covered entities and their business associates were required to enter into new business associate agreements (“BAAs”) or modify existing BAAs by Sept. 23, 2013. However, existing BAAs that (i) were entered into on or before Jan. 25, 2013; (ii) met the requirements that were applicable prior to the promulgation of the Final Rule; and (iii) were not modified after March 26, 2013, have until Sept. 23, 2014 to be updated. That deadline is quickly approaching.

Revising and modifying existing BAAs can be a challenge, especially in light of the onerous requirements ushered in by the Final Rule, but covered entities and business associates must take the time to renegotiate terms governing their agreements. It is important to remember that a contract to do business is not the same as a BAA – they are separate. As with any contract, the BAA should reflect both parties’ specific needs and protect their interests. Relying on standardized forms is never recommended. The boilerplate language in these generally lacks the detail and specificity that most parties find necessary.

If a current BAA is based on a standardized form (such as the one accessible on the Office for Civil Rights’ website), now is the perfect time to think critically about the document’s provisions and make changes. There are several tailored terms that can be drafted into a BAA to further specify parties’ rights and responsibilities beyond what is required by the Final Rule. For example, many covered entities prefer to include notification procedures in the event of a breach. The HITECH Act requires business associates to notify covered entities of a breach of personal health information within 60 days of discovery. However, covered entities may want to allow for a much shorter notification period, such as 14 days, to protect relationships with patients and to allow for quicker remedial action. BAAs may also include provisions that may mitigate the costs of addressing a breach as well as indemnify against civil monetary penalties issued by the Office for Civil Rights. At minimum, the document should always address the specific purpose of the agreement and authorized used of the PHI.

The terms of any BAA will be highly dependent on the nature of the PHI involved, the accessibility to it, and the amount of it. These factors must be thoroughly contemplated by the parties in advance of the September 23^rd deadline.