Deborah -- Yes according to § 164.532(b) if a covered entity had a contract in place with a BA on October 14, 2002, then the covered entity must amend that contract to include the required BA provisions the next time that the parties substantively modify the agreement but in no event later than April 14, 2004. A evergreen renewal does not constitute a substantive modification. So if the CE and the BA substantively modified their agreement after October 14, they should have included the BA provisions.
My advice to clients is similar to the approach that you have taken. However, if the CE has contracts eligible for the transition rule that it can't amend by April 14, 2002, then the CE should send the BA a letter now placing the BA on notice about the various HIPAA obligations. The OCR 12/4/02 guidance on BA's has a useful list of such obligations that apply during the transition period. I have quoted that Q & A below. Best regards, Dave Ermer Q: What are a covered entity's obligations under the HIPAA Privacy Rule with respect to protected health information held by a business associate during the contract transition period? A: During the contract transition period, covered entities must observe the following responsibilities with respect to protected health information held by their business associates: Make information available to the Secretary, including information held by a business associate, as necessary for the Secretary to determine compliance by the covered entity. Fulfill an individual's rights to access and amend his or her protected health information contained in a designated record set, including information held by a business associate, if appropriate, and receive an accounting of disclosures by a business associate. Mitigate, to the extent practicable, any harmful effect that is known to the covered entity of an impermissible use or disclosure of protected health information by its business associate. Covered entities are required to ensure, in whatever reasonable manner deemed effective by the covered entity, the appropriate cooperation by their business associates in meeting these requirements during the transition period. However, a covered entity is not required to obtain the satisfactory assurances required by the Privacy Rule from a business associate to which the transition period applies. Of course, even during the transition period, covered entities still may only disclose protected health information to a business associate for a purpose permitted under the Rule and must apply the minimum necessary standard, as appropriate, to such disclosures. Gordon & Barnett Attorneys at Law 1133 21st St., NW, Suite 450 Washington, DC 20036 202-833-3400 ext 3009 (voice) 202-223-0120 (fax) www.gordon-barnett.com >>> Deborah Campbell <[EMAIL PROTECTED]> 04/01/03 10:52AM >>> Craig, The way I understand this (correct me if I'm wrong guys), if you have a contract in place by October 2002, you have a 1 year extension for the BAA. But the Covered Entity is still responsible for the BA abiding by the BA requirements, even though you have waited another year to get a contract signed. We have decided to go ahead and amend the current contracts anyway. Deborah Deborah Campbell Compliance Coordinator Dominion Dental Services, Inc. 115 South Union Street, Suite 300 Alexandria, Virginia 22314 Phn: (703) 518-5000 ext. 3035 Fax: (703) 518-8849 Toll Free: 888-518-5338 Email: [EMAIL PROTECTED] ******************************************* The information in this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it is prohibited and may be unlawful. ********************************************************************* -----Original Message----- From: Craig Moen [mailto:[EMAIL PROTECTED] Sent: Tuesday, April 01, 2003 10:52 AM To: WEDI SNIP Privacy Workgroup List Subject: More Business Associate Can someone help me understand this a little better: I am reading language about having contracts signed before October of 2002. It seems to states that Business Associate agreements/addendums have an extension to 4-14-04 in these instances? For those that we have verbal agreements with we have to have something in place by 4-14-03. Sounds a little strange, because contracts signed before October 2002 may have confidentiality policies etc, but not necessarily the language required by HIPAA(the way I have read it) Thanks for any clarification Craig Moen Director of Rehabilitation HIPAA Privacy Official THERAPY 2000 Confidential Information This email message is intended only for the person or entity to which it is addressed. Unless otherwise indicated or obvious by the nature of this transmittal, the information contained in this email message is privileged and confidential, intended for the use of the intended recipient (or the employee or agent responsible to deliver to the intended recipient), you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message THERAPY 2000 1881 Sylvan Avenue Suite 210 Dallas, Tx 75208 --- The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/. These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services. They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time. You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED] To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED] If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org --- The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/. These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services. They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time. You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED] To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED] If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org --- The WEDI SNIP listserv to which you are subscribed is not moderated. The discussions on this listserv therefore represent the views of the individual participants, and do not necessarily represent the views of the WEDI Board of Directors nor WEDI SNIP. If you wish to receive an official opinion, post your question to the WEDI SNIP Issues Database at http://snip.wedi.org/tracking/. These listservs should not be used for commercial marketing purposes or discussion of specific vendor products and services. They also are not intended to be used as a forum for personal disagreements or unprofessional communication at any time. You are currently subscribed to wedi-privacy as: [EMAIL PROTECTED] To unsubscribe from this list, go to the Subscribe/Unsubscribe form at http://subscribe.wedi.org or send a blank email to [EMAIL PROTECTED] If you need to unsubscribe but your current email address is not the same as the address subscribed to the list, please use the Subscribe/Unsubscribe form at http://subscribe.wedi.org
