Subject to certain exceptions, the HIPAA rules require that covered entities enter into contracts with their BA's to ensure that the BA's will appropriately safeguard PHI. Exceptions to the BA standard includes: (1) disclosures by a covered entity to a health care provider for treatment of the individual; (2) disclosures to a health plan sponsor, provided that the group health plan's documents have been amended to limit the disclosures; and (3) the collection and sharing of PHI by a health plan that is a public benefits program. It is important to determine whether a BA contract is required due to the potential for heavy penalties. In 2016, the U.S. Department of Health and Human Services fined a hospital over $1.5 million when it discovered a six month period during which PHI was transferred to the hospital's BA without an agreement in place.
Verify that a Business Associate Agreement is in-place with all service providers that handle PHI.
Implement administrative, physical, and technical safeguards to protect PHI.
Identify and report breaches of security.
Develop policies for HIPAA / HITECH compliance.
Impose disciplinary actions where employees or vendors violate HIPAA / HITECH obligations.
Maintain HIPAA and HITECH relevant documentation for such periods as required by law.