• E-mail
• Print
• RSS

Tip: The 10 commitments of business associate contracting

HIPAA Weekly Advisor, February 21, 2003

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

Don't make business associate contracts too complicated, says Alan S. Goldberg, Esq., partner at Goulston & Storrs, in Washington, DC, adjunct professor at Suffolk University, in Boston, and the University of Maryland Law Schools, and Webmaster of Healthlawyer.com. Just make sure they require the business associate to do the following:

1. Not use or disclose PHI other than as permitted by contract or required by law

2. Use appropriate safeguards to prevent unauthorized use or disclosure

3. Report unauthorized use or disclosure it becomes aware of

4. Ensure that agents agree to the same covenants and restrictions

5. Make PHI available for individual access

6. Make PHI available for amendment, and incorporate amendments as appropriate

7. Make PHI available for accounting

8. Make compliance books and records available to HHS to determine the covered entity's compliance

9. Return or destroy all PHI at the end of the arrangement, or if unfeasible, keep and protect it

10. Authorize termination if the covered entity determines that the business associate violated a material term of the contract, unless inconsistent with statutory obligations of the covered entity or business associate

Editor's note: Excerpted from the February 2003 issue of Briefings on HIPAA.

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

• E-mail to a Colleague
• Print
• RSS
• Archive