If you sponsor a group health plan that is subject to the HIPAA Privacy and Security Rules, it is time to review and potentially update your business associate agreements.
On Jan. 25, 2013, the Department of Health and Human Services (HHS) issued significant new guidance on the rules that govern protected health information (PHI) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), hereinafter referred to as “the Omnibus Rule.” The Omnibus rule requires group health plans and their business associates to make changes to business associate agreements.
Background
The HITECH Act made many of the provisions of the Privacy and Security Rules directly applicable to business associates in the same way that they apply to covered entities. In implementing the HITECH Act, the Omnibus Rule expands the definition of business associate, applying the Privacy and Security Rules to agents and subcontractors of covered entities and business associates. The Omnibus Rule also expands potential liability for a group health plan and business associate for the actions of an agent.
Action Items
Business associate agreements may need to be amended to reflect the Omnibus Rule. To the extent not already amended, such agreements must now provide that business associates will do the following:
-
Comply with the applicable provisions of the Privacy and Security rules;
-
Report breaches of unsecured PHI to the covered entity;
-
Comply with a health plan’s obligations under the Privacy Rule when acting on the group health plan’s behalf to satisfy them;
-
Disclose PHI as necessary to satisfy a participant’s request for an electronic copy of PHI; and
-
Provide PHI when required by HHS to facilitate investigation of the business associate.
Business associate agreements must also require the business associate to enter into an agreement with subcontractors of the business associate that create, receive, maintain, or transmit electronic PHI on behalf of the business associate that such such subcontractors will safeguard the information.
The Department of Health and Human Services has published sample business associate agreement language on its website.
Effective Date for Business Associate Contracts
Existing Contracts—Sept. 22, 2014: Business associate agreements that were in existence as of Jan. 25, 2013, that are compliant, and that are not revised or renegotiated between March 26, 2013 and Sept. 23, 2013, do not have to be revised to incorporate the new requirements until Sept. 23, 2014.
If a contract that exists on Jan. 25, 2013, is not otherwise compliant with HIPAA, a new contract must be adopted by Sept. 23, 2013.
New or Renegotiated Business Associate Contracts: Business associate agreements that are re-negotiated and revised, or newly entered into after March 26, 2013, must include the provisions required by the Omnibus Rule.
For a further discussion of the changes made by the Omnibus Rule, please see our related advisory.
