• E-mail
• Print
• RSS

Tip: Include trading partner provisions in business associate contracts

HIPAA Weekly Advisor, August 14, 2003

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

The final security rule eliminated chain-of-trust agreements and required covered facilities to add security provisions to business associate contracts covering electronic PHI. You might as well add trading partner provisions, too, says Rebecca Williams, Esq., RN, partner and co-chair of the HIPAA group at Davis Wright Tremaine LLP, in Seattle.

Trading partner agreements explain what channels will be used to transmit covered transactions. They also list the rules for exchanging information, explains Williams. You can't agree to use formats or code sets that do not comply with the federal standards, she says. "But you can describe where information will be sent and how many days it will take to process claims." You may include what network or type of encryption will be used, as well as list the people responsible for overseeing transactions, Williams says.

The transactions and code sets rule does not require trading partner agreements, but references them in the negative, says Williams. "With the privacy rule, you knew where you stood with business associate contracts. The rule was very affirmative. It identified when business associate contracts need to be implemented and listed what they must include." But the transactions rule seems to presume the existence of trading partner agreements, even though they're not defined and there are no required elements, she says. "They say, 'By the way, don't do this in your trading partner agreements.' It certainly sounds like HHS expects there to be contracts."

The transactions rule basically says agreements cannot circumvent the imposed standards, says Williams. "You can't say, 'Let's ignore HIPAA.' "

Look at each scenario separately to determine whether to combine business associate and trading partner agreements or keep them separate, she says. Business associates are often also trading partners, but not always. By the same token, trading partners aren't necessarily business associates, says Williams. "A clearinghouse is a business associate and a trading partner. But another covered entity, like a physician practice that works closely with a hospital and exchanges information regularly, may be a trading partner but not a business associate," she says. "And a payer is not necessarily a business associate but likely is a business partner."

Many facilities will develop trading partner agreements for their top payers, says Williams. "But when there is overlap, include the provisions in business associate contracts, instead."

Editor's note: From the August 2003 issue of Briefings on HIPAA.

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

• E-mail to a Colleague
• Print
• RSS
• Archive