Who Is a Business Associate?
A business associate is a person or entity that creates, receives, maintains, or transmits PHI on behalf of a covered entity in the course of providing services to the covered entity. Common business associates for employer health plans include TPAs, PBMs, stop-loss carriers, utilization review organizations, and benefits administration platforms.
Required BAA Provisions
- Describe the permitted and required uses and disclosures of PHI by the business associate
- Require the business associate to not use or disclose PHI other than as permitted or required by the BAA
- Require the business associate to implement appropriate safeguards to protect PHI
- Require the business associate to report any use or disclosure not provided for by the BAA, including breaches
- Require the business associate to ensure any subcontractors agree to the same restrictions
- Require the business associate to return or destroy PHI at the end of the relationship
- Authorize the covered entity to terminate the BAA if the business associate violates a material term
BAA Audit
Compliance Note
Many employers have BAAs in place but have not reviewed them in years. BAA requirements were significantly updated by the HITECH Act in 2009 and the 2013 Omnibus Rule. If your BAAs predate 2013, they likely do not include all required provisions. Conduct a BAA audit to confirm all business associates have current, compliant BAAs.