Chester County Medicine Winter 2019 - 18

www.CHESTERCMS.org

A Refresher on Business
Associate Agreements
BY VASILIOS J. KALOGREDIS, ESQ., AND ANDREW STEIN, ESQ.

Due to their legal necessity, and resultant ubiquity, nearly all medical
practitioners and practices have at least a general familiarity with the
Business Associate Agreement ("BAA"). However, like with most ubiquitous
things, sometimes it is worth taking a step back to remind ourselves of the
what, when, and why. That is particularly true when the thing in question is
a contract subject to numerous regulatory requirements. This articles aims
to provide just such a refresher.

The What.
Many may think of BAAs as nothing more than a standard form, like any other, to be
quickly signed before getting on with the business of collaborating with a third party. The
truth is that they represent a crucial tool defining the rights and obligations of the parties
involved. They also represent an important line of defense in the protection of patients'
protected health information ("PHI").
Vasilios J. Kalogredis, Esq.

To determine more clearly what a BAA is, we turn to the regulations promulgated
in connection with the Health Insurance Portability and Accountability Act of 1996
("HIPAA"). The regulations at 45 C.F.R. § 164.502(e)(1) discuss how and when a
covered entity may disclose PHI to a business associate. To understand this requires the
definition of both "covered entity" and "business associate." As to the former, "covered
entity" is defined at 45 C.F.R. §160.103 as a health plan, a health care clearinghouse
or "a health care provider who transmits any health information in electronic form in
connection with a transaction covered by this subchapter." As most of you will know, a
common example of a "transaction covered by this subchapter" is electronic billing for
services rendered.
As to the latter, the definition of "business associate" at 45 C.F.R. § 160.103 essentially
describes an individual or organization outside the workforce of the covered entity that
"creates, receives, maintains, or transmits" PHI for purposes including "claims processing
or administration, data analysis, processing or administration, utilization review, quality
assurance, . . . billing, benefit management, practice management, and repricing." The
purposes also include the eight categories of patient safety activities listed at 42 C.F.R. §
3.20. The regulations at 45 C.F.R. § 160.103(4) describe what a business associate is not,
which helps to more clearly define the limits of the definition. Note, also, that a covered
entity may be a business associate of another covered entity. 45 C.F.R. § 160.103(2).

Andrew Stein, Esq.

With the parties to a BAA defined, it is time to address the definition and requirements
of the BAA itself. In the simplest sense, the BAA is a contract between a covered entity
and a business associate (or between a business associate and its subcontractor) aimed
at documenting assurances related to the business associate's handling of PHI. The

18 CHESTER COUNT Y Medicine | WINTER 2019

http://www.chestercms.org

Chester County Medicine Winter 2019

Table of Contents for the Digital Edition of Chester County Medicine Winter 2019