# Presentation: 673006

## Business Associate Agreements 

**Business Associate Agreements**

**James (Mickey) Gwyn**
**Business Associate Component Liaison****VHA Privacy Office **
**VHA Office of Information**

**9-10 October 2007**

## AGENDA

- HIPAA 101
- Business Associate Provisions
- VA Standard Operating Procedures
- Available Resources
- Questions

## The Statutes

**HIPAA 101**

## HIPAA 101

- Health Insurance Portability and Accountability Act (HIPAA) was passed by Congress in 1996
- Public Law 104-191
- Original objection was the inability to transfer health insurance
- Section 262 - Administrative Simplification was added at the request of the Healthcare Industry
- Fines of up to $25,000 for incidental violations
- Fines of up to $250,000 for intentional violations
- Even up to 10 years in prison for violations with criminal intent!

## HIPAA 101

## Business Associate Provisions

**§ 164.502 Uses and disclosures of protected health information: general rules**
**(e)(1) Standard: disclosures to business associates**
**§ 164.504 Uses and disclosures: organizational requirements**
**(e)(1) Standard: business associate contracts **
- (2) Implementation specifications: business associate contracts
- (3) Implementation specifications: other arrangements
- (4) Implementation specifications: other requirements for contracts

## Business Associate Provisions 

- _Covered Entity (CE)_
- 	A health plan, health care clearinghouse, or health care provider who transmits any health information in electronic form in connection with a transaction. (VHA or its facilities are the only Covered Entities in VA)
- _Business Associate (BA)_
- 	A person or entity that performs certain functions or activities that involve the use or disclosure of _*protected health information*_*** on behalf of, or as a provision of services to, a _covered entity_._ _
- _Business Associate Agreement (BAA)_
- 	A written agreement, between _business associate_ and _covered entity_, stating mandatory provisions regarding the use and disclosure of _*protected health information*_*.**
**Protected Health Information*: Individually Identifiable Health
-   Information.

## “It Takes Three” 

- Covered Entity
- Functions, Activities or Services Provided Outside of Covered Entity
- Requires Use of PHI

**Business Associate Provisions**

## Questions to Ask

- Does the device/software interface with VistA where PHI resides?
- Does the device/software store PHI on an internal hard drive or remote server?
- Is there remote access to the device/software?
- How do we handle trade-in of devices and removal of sensitive data?
- Are these incidental disclosures?
**    ****However, an incidental use or disclosure that occurs as a result of a failure to apply reasonable safeguards or the minimum necessary standard, where required, is not a permissible use or disclosure and, therefore, is a violation of the Privacy Rule.**

**VA Standard Operating Procedures**

## National Level BAAs

- Process approved by Department of Health and Human Services
- Negotiated by VHA Privacy Office
- Signature Authority Within Office of Director, Health Data & Informatics
- Covers every VHA site that has an arrangement with the vendor
- Periodic review

**VA Standard Operating Procedures**

## Unique VA Language

- Ensure any employee of BA, contractor, subcontractor or agent of BA performing functions requiring access to PHI receives at least annual privacy training that conforms to the requirements of VHA Privacy Training;
- Ensure any employee of BA, contractor, subcontractor or agent of BA performing functions requiring access to PHI receives at least annual security awareness training that conforms to the requirements of the Department of Veterans Affairs Office of Cyber and Information Security Training;

**VA Standard Operating Procedures**

## Unique VA Language

** ****Public Law 109-461, Title IX (Department of Veterans Affairs Information Security Enhancement Act of 2006) states:  **

**VA Standard Operating Procedures**

**The Secretary shall ensure that the Department**
**information security program includes the following elements:**
- Annual security awareness training for all Department
- employees, contractors, and all other users of VA sensitive
- data and Department information systems that identifies the
- information security risks associated with the activities of such
- employees, contractors, and users and the responsibilities of
- such employees, contractors, and users to comply with
- Department policies and procedures designed to reduce such
- risks.

##     Within 24 hours of Business Associate first becoming aware of a HIPAA Electronic Transactions and Code Sets, Privacy, Security or Standard Identifier Incident, or Use or Disclosure of PHI not provided for by this BAA, notify the Covered Entity and promptly provide a report to Covered Entity. 

- Unique VA Language

**VA Standard Operating Procedures**

##     An incident will be considered any attempted or successful unauthorized access to, use, disclosure, modification, or destruction of, or interference with PHI, or an event that causes the Covered Entity to be considered non-compliant with the Administrative Simplification provisions of HIPAA as determined by the Department of Health and Human Services.

- Unique VA Language

**VA Standard Operating Procedures**

## 
    Utilize only contractors, subcontractors, or agents who are physically located within a jurisdiction subject to the laws of the United States. Business associate will ensure that it does not use or disclose PHI received from Covered Entity in any way that will remove the PHI from such jurisdiction.

-     Utilize only contractors, subcontractors, or agents who are physically located within a jurisdiction subject to the laws of the United States. Business associate will ensure that it does not use or disclose PHI received from Covered Entity in any way that will remove the PHI from such jurisdiction.

- Unique VA Language

**VA Standard Operating Procedures**

##     Upon completion of the applicable contract(s) or agreement(s), the Business Associate shall return or destroy the PHI gathered, created, received or processed during the performance of the contract(s) or agreement(s), and no data will be retained by the Business Associate, or any agents or subcontractors of the Business Associate, unless retention is required by law or regulation or expressly permitted herein.  The Business Associate shall assure that all PHI has been returned to the Covered Entity, destroyed by Business Associate, or both; as deemed appropriate by Covered Entity.  If immediate return or destruction of all data is not possible, the Business Associate shall assure that all PHI retained will be safeguarded to prevent unauthorized Uses or Disclosures.  Until the Business Associate provides assurance, Covered Entity may withhold 15% of the final payment of the contract(s) or agreement(s). 

- Unique VA Language

**VA Standard Operating Procedures**

## Health and Human Services FAQs
http://answers.hhs.gov/cgi-bin/hhs.cfg/php/enduser/std_alp.php

Health and Human Services BA Guidelines
http://www.hhs.gov/ocr/hipaa/guidelines/businessassociates.pdf

Signed National BAAs
http://vaww1.va.gov/cbo/hipaa/signedbaa1.asp

_**[http://answers.hhs.gov/cgi-bin/hhs.cfg/php/enduser/std_alp.php](http://answers.hhs.gov/cgi-bin/hhs.cfg/php/enduser/std_alp.php)**_
- Health and Human Services BA Guidelines
_**[http://](http://www.hhs.gov/ocr/hipaa/guidelines/businessassociates.pdf)**__**[www.hhs.gov/ocr/hipaa/guidelines/businessassociates.pdf](http://www.hhs.gov/ocr/hipaa/guidelines/businessassociates.pdf)**_
- Signed National BAAs
_**[http://vaww1.va.gov/cbo/hipaa/signedbaa1.asp](http://vaww1.va.gov/cbo/hipaa/signedbaa1.asp)**_

- Available Resources

## Available Resources

**James "Mickey" Gwyn**
**Business Associate Component Liaison**
**VHA Office of Information****(615) 278-3658 Office****(615) 278-3702 Fax**_**james.gwyn@va.gov**_** **
**VHA Privacy Office**
**202-461-5861**

##      Questions