Generally, a Business Associate Agreement is a written agreement between a Covered Entity (Doctor, Clinic, Hospital, HMO, etc) and a Business Associate that establishes the permitted and required uses and disclosures of personal health information by the Business Associate.  Most often, a Business Associate is a vendor who creates, receives, maintains or transmits personal health information.  Although a Business Associate can provide a variety of different services, the most common services provided will usually be billing services, claims processing, data analysis and electronic storage.

Thanks in part to the 2013 Omnibus Rule, the number of entities required to enter into a business associate agreement will skyrocket in the near future because all subcontractors of the business associate must also enter into Business Associate Agreements. So for example, not only must a company that provides offsite, electronic storage for a medical practice’s records have to enter into a Business Associate Agreement with the medical practice, but that company must also enter into a Business Associate Agreement with any subcontractors it hires to assist it with that electronic storage.

Of course not every entity that provides a service to a Covered Entity must enter into a Business Associate Agreement.  Health care providers disclosing personal health information for treatment purposes are specifically exempted from these rules. (i.e. physician does not need a Business Associate Agreement with a laboratory as a condition of disclosing personal health information).  Health care providers disclosing personal health information to insurance companies are also exempt.  Entities that merely have incidental contact with protected health information (such as a cleaning service) also do not have to enter into Business Associate Agreements.

There are a host of other exemptions that apply.  For more information or assistance on this topic contact our office.