HHS Provides New Sample Business Associate Agreement

The U.S. Department of Health and Human Services’ (HHS) Office for Civil Rights published a new sample business associate agreement on January 25, 2013, to go along with the final omnibus rule that updated the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act (see the January 23, 2013, HRC Alerts). The sample agreement will help facilities manage the new privacy and security requirements for business associates, which HHS has defined as “a person or entity, other than a member of the workforce of a covered entity who performs functions or activities on behalf of, or provides certain services to, a covered entity that involve access by the business associate to protected health information” and “a subcontractor that creates, receives, maintains, or transmits protected health information on behalf of another business associate.”