What is a Business Associate?
As stated on the HHS website, "Business Associate Defined - In general, a business associate is a person or organization,other than a member of a covered entity's workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of individually identifiable health information. Business associate functions or activities on behalf of a covered entity include claims processing, data analysis, utilization review, and billing.
Business associate services to a covered entity are limited to legal, actuarial, accounting, consulting,data aggregation, management, administrative, accreditation, or financial services.However, persons or organizations are not considered business associates if their functions or services do not involve the use or disclosure of protected health information,and where any access to protected health information by such persons would be incidental, if at all. A covered entity can be the business associate of another covered entity.
What is a Business Associate Contract or Agreement?
Again as stated on the HHS website, "Business Associate Contract - When a covered entity uses a contractor or other non-workforce member to perform "business associate" services or activities, the Rule requires that the covered entity include certain protections for the information in a business associate agreement (in certain circumstances governmental entities may use alternative means to achieve the same protections). In the business associate contract, a covered entity must impose specified written safeguards on the individually identifiable health information used or disclosed by its business associates. Moreover, a covered entity may not contractually authorize its business associate to make any use or disclosure of protected health information that would violate the Rule.Covered entities that have an existing written contract or agreement with business associates prior to October 15, 2002, which is not renewed or modified prior to April 14, 2003, are permitted to continue to operate under that contract until they renew the contract or April 14, 2004, whichever is first.
Sample Business Associate Agreement from different websites:
Found on the HHS website -- Sample business associate contract language is available on the OCR website at: http://www.hhs.gov/ocr/hipaa/contractprov.html.
Found on the HIPAA Survival Guide website --http://www.hipaasurvivalguide.com/business-associate-agreement.php
Found on NCHICA website --http://www.nchica.org/HIPAAResources/Samples/NCHICABAA.doc