Most common BA question regarding HIPAA Omnibus

We have received a lot of questions from our clients regarding the changes to HIPAA from the HIPAA Omnibus Rule. The most common question to date has been around Business Associate Agreements (BAAs). The questions come from covered entities as well as business associates. The question is basically the same for a different perspective.

We are a covered entity, do we have to have business associate agreements with all of our business associate’s subcontractors?

We are a business associate, do all of our subcontractors have to have business associate agreements with our covered entities?

The main reason for the questions is that the HIPAA Omnibus Rule made it clear that covered entities have to have business associate agreements with all business associates. Furthermore, business associates have to have business associates agreements with their subcontractors (business associates of business associates).

So naturally clients are asking if the subcontractors of business associates have to have business associate agreements with covered entities. The answer is NO!

Think of the business associate agreements as a chain of responsibility.

CEs have to have BAAs with BAs. —-> BAs have to have BAAs with subcontractors (BAs of BAs)

CEs do not ( ) have to have BAAs with subcontractors of BAs

CE –>> BA –>> Subcontractor (BA of BA)

Hopefully this clears up any questions regarding Business Associate Agreements between CEs and BAs. If you have any questions feel free to leave them in the comments sections.

The HIPAA Omnibus Rule greatly expands which organizations are responsible for complying with HIPAA. Many of these organizations have not put in place the required security measures to ensure compliance. We have developed our HIPAA Business Associate Program to address the needs of Business Associates. Take our 4 question quiz to help determine if your organization is now a Business Associate. If you determine that your organization is a Business Associate, we can help with our quick, easy and inexpensive path to HIPAA compliance!