Home -> Law Blog Directory -> Law Students Blogs -> LawTechTV

OR PHONE (866) 635-1838 for Bankruptcy Help, (866) 635-6190 for Divorce,
(866) 635-2689 for Personal Injury or (866) 635-9402 for Criminal Defense

Find a Local Lawyer

Bankruptcy (866) 635-1838
Divorce (866) 635-6190
Personal Injury (866) 635-2689
Criminal Defense (866) 635-9402

Law Students

: LawTechTV

Business Associates: That was then, this is now

ADVERTISEMENTS

Until the HITECH Act was enacted into law on February 17, 2009, as part of ARRA, a business associate's ("BA") compliance with HIPAA's Regulations was mandated only as part of the contract (see 164.504(e)(1) ) with its respective Covered Entity ("CE"). Under HITECH a BA is "directly on the hook" (i.e. via statutory authority) for complying with the following sections of the HIPAA Security Rule("SR"):

Administrative Safeguards (see §164.308 );

Physical Safeguards (see §164.310 );

Technical Safeguards (see §164.312 ); and

Policies and Procedures and Documentation Requirements(see §164.316 ).

BA compliance with the required sections of the SR were to go into effect one year post the enactment of HITECH, however, HHS (circa February 2010) delayed the compliance effective date for BAs, apparently to provide a little more breathing room to the impacted entities (see HITECH Effective Dates One Year Out).

In addition to the sections enumerated above, HITECH Section 13401states as follows:

The additional requirements of this title that relate to security and that are made applicable with respect to covered entities shall also be applicable to such a business associate and shall be incorporated into the business associate agreement between the business associate and the covered entity.

In short, a BA must comply with the enumerated sections above in the same way a CE is required to comply, and must also comply with any additional HITECH security requirements imposed upon a CE (e.g.Breach Notification). Finally, any additional HITECH security requirements must be incorporated into the contract between the respective parties. There is still some debate regarding this latter requirement, but the conservative approach is to review existing BA agreements and to add a HITECH Act addendum to eliminate the guessing game.