Robin,
1)
The BAC would be in effect as long as the stated duration (in
the BAC).
2)
If the BA has no understanding of HIPAA, then, in all
probability, a CE would be precluded from sharing PHI with that BA.
3)
Usually, no BAC is needed for the purpose of sharing PHI for
treatment
Robyn,
1) The term of the BA contract is as long as it itself
states.
2) Other than using another entity, I'm not sure. You
are responsible for whatever PHI they leak, unless you have that contract in
place makeing them responsible for their actons.
3) I think your list covers everything,
