However, if the covered entity has performed its due diligence prior to the conclusion of an agreement, these situations are rare. Assuming that the covered company is diligent, it is unlikely that the covered business will be guilty if a supplier violates the BAA and in any way violates HIPAA. If the creditor signs the document, he assumes responsibility for safeguarding the PHI. 5.9 Full agreement. This agreement contains the full agreement and agreement between the parties on the purpose of this issue and replaces all prior agreements, agreements and assurances regarding this purpose. The direct staff of this organization are not required to sign an BAA because they are part of your organization and are not considered a business partner. Yet they are still covered by HIPAA laws. As an employer, you have a responsibility to train your staff in how to preserve the integrity and disqualification of protected health information. Finally, failure to comply with the requirements of an agreement by a partner or subcontractor could have significant consequences: according to the law, the HIPAA data protection rule applies only to covered companies: health plans, clearing houses in the health sector and certain health care providers. However, most health care providers and health plans do not perform all of their health activities and functions themselves. Instead, they often use the services of many other individuals or businesses. The data protection rule allows providers and covered health plans to transmit protected health information to these “counterparties” when providers or plans receive satisfactory assurances that the counterparty uses the information only for the purposes for which it was mandated by the covered entity, which protects the information from abuse and helps the added entity fulfill some of the obligations of the entity covered under the data protection rule.
Covered companies may disclose protected health information to a company in its role as a business partner only to assist the insured company in fulfilling its health missions – not for independent use or for the purposes of counterparty, unless it is necessary for the proper management and management of the counterparty. (iv) all reports submitted to the entity insured by the counterparty specify at least: (i) the nature of the unauthorized use or advertising; (ii) the phi used or disclosed, (iii) the party or parties who have made the unauthorized use or received the unauthorized disclosure, (iv) the corrective actions that the counterparty has taken or will take to prevent any further unauthorized use or disclosure, v) what Business Associate has done or will do to mitigate the adverse effects of unauthorized use or disclosure , (vi) and any other information that HHS may prescribe by regulation. Transitional provisions for existing contracts. Covered companies (excluding small health plans) that have entered into an existing contract (or other written agreement) with consideration prior to October 15, 2002 may continue to work under this contract beyond April 14, 2003 until an additional year, unless the contract is extended or amended before April 14, 2003.