by Kim C. Stanger, Holland & Hart LLP

If they have not already done so, the deadline for covered entities and business associates to update their HIPAA business associate agreements to comply with Omnibus Rule requirements is September 22, 2014.

BAA Requirements. HIPAA requires that covered entities and business associates execute contracts (called “business associate agreements” or “BAAs”) which require that business associates comply with certain portions of the HIPAA Privacy, Security and Breach Notification Rules. (45 CFR 164.314(a)), 164.502(e), and 164.504(e)). The HIPAA Omnibus Rule changed BAA requirements. Under the Omnibus Rule, covered entities and business associates must modify their BAAs to require business associates to:

• comply with the HIPAA Security Rule;
• execute BAAs with any of their subcontractors that create, receive, maintain, or transmit protected health information on behalf of the business associate;
• report security incidents, including breaches of unsecured health information; and
• comply with the Privacy Rule requirements applicable to covered entities if and to the extent the business associate is to carry out a covered entity’s obligations under the Privacy Rule.

(45 CFR 164.314(a) and 164.502(e)). For a checklist of all required BAA terms, click here. The Office for Civil Rights (“OCR”) has also published sample BAA provisions, although the OCR sample may not include additional terms that covered entities or business associates may want to include in their BAAs. Continue reading →