Sign Nevada Banking Business Associate Agreement Myself

Industry sign banking nevada business associate agreement myself

okay good afternoon everyone and welcome to this second installment of a collaborative webinar series on HIPAA business associates this webinar series is sponsored by keith is health and q IP solutions and we're continuing to cover timely and relevant topics regarding about specific to business i am at a boolean of q IP solutions and i'm joined today by president of kisses health susan printer good afternoon Susan Oh Adam thank you for inviting me and by wave housekeeping we will take questions at the end if there are any will reserve some time for that you can use the raised hand function under the mood button during the course of the presentation if you have questions I will then on YouTube and you can address your question or you can use the chat function on the left side of your screen so about today's webinar as I mentioned today we're discussing business associate agreements and this is the contractual relationship between covered entities and business associates as well as with subcontractors and just by way of recap before we move into the substantive information we want to cover today I want to remind everyone that this is part two of our series in part one we discussed be what when why and who a business associate compliance with HIPAA and I would encourage anyone who hasn't to take a look at the recording of that presentation it does have valuable foundational information regarding HIPAA and specific to business associate compliance in HIPAA and on to today's topic a business associate agreement so I will turn it over to Susan's she will talk about the 10 business associate agreement essentials and then specific to how to negotiate business associate agreements from the perspective of this is associate and we'll look at a few examples so the floor is yours Susan thank okay thank you adam and welcome to the webinar I just wanted to pick out some of the 10 essential elements that were mentioned in under this final bill we run into many situations where our business associates aren't even aware that they are business associates so if you're confused about that it would be good to look at that criteria which I'm sure they went over in the prior webinar but these are some of the provisions that are now required to be our elements in any different social treaments between a covered entity and their business associates so you will see this in each of those agreements if you're not presenting your own business purchase agreement to your covered entities technically they should have been amended as a after january first 2013 because the Omnibus final rule went in in this at that time and required an update that would have fun in some of these provisions if they weren't already present which not all of them would have been based on previous requirements so running through them quickly there would be a section on permitted uses and disclosures and a statement in there about what the be a real used or not do in terms of dispersions thi for reasons that are not permitted are required by the rule you're required to implement the HIPAA safeguards ravenna unauthorized use or disclosure and report to the covered entity unauthorized use or disclosure this one number four becomes quite tricky for our business associates if you are seeing a breach of pH I by your organization there will be a time frame probably highlighted in the business associate agreement I've seen it everywhere from immediately you will report to your covered entity if you have detected them a bleach from stay five days some days two days one attempted to do 30 days we were working on the covered entity at that time and the covered entity only has 30 days to notify the patient when there's been a breach so it is impractical for BA to report that late to the covered entity so you want to watch what those requirements is I would suspect that you have signed there's an associate agreements with a lot of variety to their frequency at how quickly you will record a breach to your covered entity I'm going on to number five and disclosing the pH I defense by the covered entities obligation this is in response to another requirement uncovered entity that the patient can ask for an accounting and this is an accounting of disclosures so they may have to come back to you for that and you would have to substantiate that you only did it as permitted by your associate agreement number six requiring you to comply with a covered under these privacy girl and maybe times will they come back to you and say do not you know forward something that you're doing on behalf of a patient because they've now changed their minds you know how will you react to that and making available to HHS and the information needed to show that you're in compliance with HIPAA your siiii also has that obligation can know that you as a business associates are also complying with hip hop and if you're not aware of what those controls are that you should have in place and you have find it an agreement you're really not in compliance already so because you to really understand the essentials that are are outlined in your business ocean green of course the termination or contract normally some might have been written that say there's the last a year well there's no need to do that and the world changes at which time you would do an addendum so most of your contract should read that it only would be cancelled or calling them cancelling your underlying agreement as a business associate you probably have some kind of service level agreement depending on what your function is for them and that will dictate that your business associate agreements should last as long as that last as long as your business with them last so just be aware of how you you've written that termination clause in your baa and then number nine assuring that the fur contractors agree to what the subconscious are great do the same thing that you have agreed to we're going to look at a couple samples of agreements and why is this important or you're now you're now responsible for any of your subcontractors that you might use they need to also comply with HIPAA and you need to be assured that they're doing that so we recommend that you actually formalize that agreement with your subcontractors using a business associate agreement with them so I'll just show you a sample of how easy that might be to modify and then of course authorizing the termination of the contract if you violate you know any material term so that would be an essential part of any business associate agreement how does the thing get terminated as i mentioned normally you'd want to do that based on whether your contract terminated for your business with them so these are some important things just to consider as you're developing a business associate agreement do you already have a standalone agreement with with your partners so and we're just incorporated maybe with your service level agreements and did you do an addendum after you know between 2013 and now for instance I should have been done by September of last year never too late to to get that on so if your agreement your original agreement was prior to January of 2013 we need an abundance that recognizing those previous requirements that we mentioned on the last slide in terms of notification again this is the thing to look at and then the agreements that you're presented from a covered entity where the timing of that notification that they're expecting for me if there were a breach and who's going to pay for that breach usually there's a been seeing dem ification at the bottom usually there's a mutual indemnification clause that says you'll handle your costs will handle ours but some of them if you're signing covered entity business associate agreements might say you know you'll cover their expenses so be very careful about the notification and the indemnification clauses and a number three destruction the return of pH I you if you did have a breach most of them read that you'll be given an opportunity to correct whatever is wrong but if they did cancel your agreement you will need to return any any documents that contain thi to them or any information that contains pH I or guarantee that you'll destroy it so those are real important points to know that you have a process in place that can handle that um Adam those are actually the major considerations I would recommend okay I do have one question so on number three if let's assume it's the natural winding down of a business relationship between a business associate and a covered entity the business associate is is holding on to ph I within the normal course of business is outlined within the business associate agreement what obligations do they have to the pH I within the natural winding down of that business relationship you mentioned number three sort of in context of a breach but it is do you have any recommendation as to what's that ph i should be returned or whether it should be returned and what kind of time frame antigen and sometimes that would be that would also be details in business agreement or and sometimes it says timely and you know so it does give you a window of opportunity there are sometimes it's in your statement of work for anyone that you would return any the optimal solution is that you as a business associate no longer retain meph i on behalf of the covered entity so the optimal situation is you have a way to guarantee that you return everything you were holding now in lieu of that let's say the covered entity went out of business okay so you may want to have something in your agreement that say if i can't return it i will be destroying it you know of whatever your decision is otherwise you will be maintaining the security of net ph I for at least six years before you destroy it someone may have to get back to you if you're the only copy of mph I of course it is it depends on what your business is and what you're trying to do but I'd say your optimal solution is always to be turn the phi2 that entity I think there's been some real odd situations where you know practice or households gone out of business and there's no a lot of misunderstanding about what to do with that data when they're not bought out by another entity so you might want to really pay attention to those clauses in your agreements to be sure that you're not on the hook for maintaining thi beyond a business relationship great so let's take a look at a agreement would you say between a business associate and covered entity first is that yeah I'm going okay and that one up just showing you example of what a typical agreement would look like if you page back up to the top the outerbridge you're okay so there's just a little statement at the beginning that you as a business pleasure will perform certain functions and activities on behalf of them and you realize that if you create receive maintainer transmitter disclose any of that information you are business osha to them so you're recognizing your obligations under HIPAA and they you know they are promising these things and most of them have some definitions in the beginning and say you know any definitions on prism or what we're going to use in the rule and then as you page down this is where it begins your obligations and your activities that you're going to perform and that goes back to both 10 points we've found the slide and then at the bottom again you're permitted uses why you're going to do anything with this information and you then you'll get into your reporting clauses and this one has like the covered entity will notify you within five days of any privacy practices issues that affect you if they have something from a patient that affects what you're doing for them they must notify you that so that you're not turning over information you know that you shouldn't be and you'll notify them this one says within five days you know anything that you understand oh no that's the code that will be still so any anything that they need to notify you you're asking them to let me know timely so I am not turning data over that I shouldn't turn over and the last part of it would then be then your termination your term and termination of this Agreement how what for cause if you they have a grief a breach or you have a breach and you cannot resolve it and they they have the app the opportunity to terminate the agreement your underlying agreement and your associate agreement so anyway these clauses are going to appear in nearly every agreement that you do so just be aware of the the ones that can hold you to the fire a little bit more than you can possibly do so just be aware of what your obligating yourself to do and maybe just simply some miscellaneous rules again indemnification clause is doing holding one another harmless if you are the one and you're not you know you're covering your own attorney fees they're covering their eternity eternity see attorney fees so just be aware of how that clause is is mentioned in your business associate agreement in this just the indemnity indemnification I mean because it covers claims penalties fines costs liabilities that would include the notification costs that we sort of touched on earlier so yeah it's really it's really all wrapped up in there and one and one one quick little right in there about you know who's responsible for what so and we might be a little clearer about that notification I was thinking about the business ocean notifying the covered entity they must then notify the patients if you know of what is going on with their records that were breached so there's a cost to that and an expectation that they do financial monitoring for them and provide that so they may want to pass they will pass that on to you as the business question if it's your problem if you were the result or you were the reason for the breach so they will want you to bear that expense so that's that's part of the notification is what they're obligated to do to the patient and they would want you they would want you to pay for that okay so shall we take a look at a business associate agreement for subcontractors yeah and this is what I'm saying a lot of a lot of business associates associates don't have this they're not recognizing their subcontractors is anything but that but they've been dragged into the HIPAA requirements just like you have as a business associate still see the language in the beginning is that business associate has engaged a subcontractor to perform season these activities some function activities on behalf of the cut its covered entity that requires the subcontractor to create your seed maintainer transnet protected health information consequently your they're subject to the HIPAA rules your expectation is they're doing these things and if they sign it they should be doing the same things you are doing so this is acknowledging that and i would recommend as you subcontract with these densities that you pass them a business associate agreement and at least open the door of the discussion will say do you realize you have the same obligations i do in terms of HIPAA so that you are assured that they're looking at the rule understand the controls and safeguards they should have in place for any protected health information that they may be doing so it's just another another way to help you help them recognize that they really are subject to work and I will and Adam I'm sure will attest with it whether you have it signed or not they are subject to HIPAA so legally they are required to do the same things you're required to do as a business associate sir it's not it's not it's not the signature on the agreement that requires somebody to to comply with the HIPAA rules it's the acceptance of the pH I regardless of whether any agreement is signed regardless you know respective to HIPAA safeguards if whatever associate or subcontractor I knowingly and willingly accepts guy into their environment than they then become subject to to have us so with very limited exceptions but but that really is is the Baker good and let's be but just for clarification this subcontractor agreement only applies to subcontractors of a business it says here who create received maintain or transmit the protected health information correct on behalf the busine s of it so those out there that they go I have to give this to all of my subcontractors no only though with connection to to your pH I or the pH out of your handle on behalf of evidence so and and the rest of the agreements isn't pretty standard what we've already seen right correct it's pretty much read you know was corrected for subcontractor language rather than covered entity but it's pretty much the same thing sure and that is that's helpful that we can use these agreements pretty much in full with basic language changes for the party and just one thing that I want to to sort of go back on and touch what Susan talked about earlier about an incorporated agreement versus standard agreement these that we've seen here today our standalone business associate agreements but from a contractual drafting standpoint they don't have to be be it what is important is that the ten provisions that we touched on those have to be incorporated into some agreement it can there's no there's no better way necessarily whether it is a standard agreement or whether it's incorporated into a service contract between two organizations as long as those provisions are in there and the things that we've also touched on are contemplated between the two partners and agree that's what you know the government's looking or at work that's what good business practices really dictate again the existence of this agreement doesn't or the non-existence of this agreement does not preclude somebody from complying with it but this is just the government has said these these have to be at these safeguards have to be in place in these agreements have to be so we will go back to our slide deck here and pick up where we left off which really that really sort of concludes the substituent part of our business associate agreement discussion what we will do is we have recorded this and we will send this out to everybody who has registered has joined us today and if anyone would like more information on the business associate agreements that we've shown or any specific provisions for agreements between different entities or business associates or Christopher canes and subcontractors let us know we can walk through those documents with with a bit more detail so I want to make sure that everybody knows they can reach out to us for additional information on those we do have three more webinars coming up on business associates part three and two weeks will be on risk assessments security risk assessments two weeks after that one month from today we'll be conducting a pH I inventory and lastly on April fifteenth will be regarding training for business associates and workforce training for business business associate so look forward to those i will send registration information for our next webinars and an email that will follow later today or tomorrow and additionally i will include in that follow-up email this information as well with the entire slide deck so you can reach out to Susan or I if you have any additional questions so I thank Susan for joining us and I look forward to connecting again with everybody on in two weeks so thank you speak to security risk vessels thanks a lot Susan appreciate it as always a good day thanks