Unlock the Power of Digital Signature Licitness for Business Associate Agreement in Mexico with airSlate SignNow

How to eSign a document: digital signature licitness for Business associate agreement in Mexico

hi my name is Samaria Dunson and I'm the director of the office of compliance and ethics here at the Alabama Department of Public Health I'm here to talk to you about business associate agreements what are they and when should we use them now if you're watching this training that means that you have access to the contracts database and if you have access to that system then that means that you're a decision maker about whether or not a business associate agreement should be used so some of the topics that I like to discuss with you are understanding who may be considered a business associate why business associate agreements are necessary and understanding the exceptions now when we talk about protected health information let's remind ourselves about what actually qualifies as protected health information so there'll be examples like that you see on the slide their name address both obvious ones date of birth a date of service that may be identify that we tend to forget about Social Security numbers diagnosis telephone numbers and emails but what we also want to consider is that there there are other forms of protected health information like full face photographs or other comparable images medical record numbers this would include not only an ad pH record number but a Medicaid record number and any other information that an individual will be able to use to identify a patient or a client and when we're talking about protected health information we want to remember that there are a couple of exclusions those Skloot exclusions include employment records so for instance here at the Department of Public Health we may be providing information on our employees to send to the retirement systems of Alabama r2p health and in doing that that would not be considered protected health information because they're not our patients or our clients there are they are our employees so that's an exclusion and then also education records would also be considered an exclusion so what is a business associate a business associate is a person or entity that creates receives maintains or transmits protected health information on behalf of the department now some examples of business associate agreements appear on this screen and I'll go into each of them a little bit the first are shredding companies we've identified them as a business associate part of the reason for that is we're providing them with protected health information when we put those medical records in those bins that Gilmore our other services pick up when we put the protected health information in those bins they are receiving our protected health information in order to do something on our behalf which is to shred the information so we wanted to make sure that we had business associate agreements in place with them because if they take those bins and misplace them or lose them before they shred the documents or if they take them and there's an accident on interstate 85 and so therefore the records are going everywhere well we want a BIA in place with them so that it's not our responsibility for that breach once it's in their hands is their responsibility another example is going to be the companies that we have leased copiers with I know a number of you have identified that we have hard drives within a number of our copiers this is can be an issue because it's those machines are actually saving for a short period of time they're saving those those copies that are going through which can have protected health information on them one way that this comes into play is that if you have someone who's coming to service that copier they could actually print off the last several jobs and see protected health information or when our lease is over with that copying company then they take the Machine the procedure is supposed to be that they wipe that hard drive clean before they leave but in case they don't do that correctly or they don't do it at all before it leaves the department we have a business associate agreement in place with those that those copier companies to say once that machine leaves a DPH property you're responsible for the pH I that's on that machine another example is going to be our software companies that remote into our computers to troubleshoot and I can further explain that in our legal office as well as the office of compliance ethics an example is going to be that we have a program called time matters and that's something that we use to put all of our cases in and we actually have from time to time protected health information that's associated with a case or associated with an investigation where there have been times in the past where for some reason that that software wasn't working or that that database wasn't working and we had to contact tech support at Time Matters which is a LexisNexis product and actually have them remote into our computer so that they can troubleshoot and fix that problem well we have a business associate agreement with them because they have the ability to access information while they're doing something on our behalf which is troubleshooting and then the final example that we have on the sheet are companies that perform mass mail outs of protected health information of our patients and I wanted to explain that a little bit further as we'll when I say mass mail outs I don't mean UPS FEDEX the United you know the United States Postal Service what I mean is a contract that we will have with a vendor or company where they will actually physically put the paper in the envelopes to mail out well there there is certainly the possibility and there have been instances in the past not very many but instances where because of the way that they have it set up if they're doing four hundred mill outs if they start getting one letter off like maybe two pages get stuck together and that goes into envelopes so all of the remaining ones are off there's the potential to have a very large breach because all of the ones that happen after that mistake will be me getting somebody else's protected health information so whenever we have a contract or an agreement with someone to do a mass mail out and it has protected health information of a patient or a client we want to make sure that they have that we have a business associate agreement in place so that that company is responsible for any breaches that they create and the Department of Public Health is not so after that I want to talk with you a little bit about what are some of the terms of a business associate agreement I actually have a copy of a business associate agreement here it's an eight page document in terms of the substance of the document and I will not attempt to read that to you in the legal world is actually a pretty short document but I did want to go over the next slide to show you some terms that are very important one of those things are the uses and disclosures of pH I it actually spells out how each party will use and disclose that information it talks about the obligations of the business associate to safeguard the pH I they have to have certain things in place to make sure that they have training and that they're not leaving that information out so that it remains confidential they also these agreements also spell out how breaches are going to be handled so for instance it'll say if a particular business associate becomes aware of a breach they have to let us know at the department within a five day period and that type of thing so how those breaches are handled are very important and then finally how pH I will be handled when the relationship is terminated and I want to explain that part a little bit further because let's say you have a contract with a group and you have a BA associated with it and you're giving them pH I well if that contract ends in January of 2016 that group still has the protected health information of your patients so these business associate agreements spell out hae in January 2016 when this relationship was over either you have to give us back all of our pH I or if that's not feasible to do you need to make sure that you destroy it or that it's safeguarded then you keep it safe so that there won't be any inappropriate disclosures that are made so I want to just review with you those terms now when considering whether a business associate agreement is necessary I want you to ask yourself a couple of questions when you're sitting down at your computer in the aces database the first question that I want you to ask is do you understand the relationship between the parties because if you don't understand the relationship between ad pH and this person or this group that we're about to provide information to then you don't you're not in a situation where you can determine whether or not a business associate relationship exists so you want to make sure that you understand the relationship the second thing I want you to make sure of is that there is actually an exchange of pH AI between the parties and more specifically is ad pH giving our patient information if we're receiving somebody else's protected health information we're not in a position to provide them with our baa but if we're providing phi2 that other party we need to make sure that we are considering having a baa if there is not an exchange of pH I you don't need to worry about a business associate agreement and then finally in sharing our pH I with the other party will that other party be providing a service on our behalf and what I mean by that is this there are certain instances in the department where just because we're required to or because they're required to by law they have to provide us with information an example of that would be our immunization database by law there are certain groups of people or entities that have to provide us information for that database and then also by law we need to share that information with other people in that relationship they're not doing anything on our behalf and we're not doing anything on anybody's behalf where everybody's just sharing information because they're legally required to do so in those instances you won't need a business associate agreement you may need something else like a data sharing agreement or a trading partner agreement which I'm happy to talk with you about and help you get those agreements ready but in terms of a business associate agreement they either need to be creating maintaining or receiving our protected health information and doing a service on our behalf after they get that protected health information the next slide shows a flowchart now this flowchart was a part of the 2013 HIPAA policy it was a part of the 2014 HIPAA policy when it was amended and I can feel very certain that it's going to be a part of the HIPAA policy that goes out this year that I think that this is a very good flow chart I've not had any issues with it in the past but if I may I just wanted to go over a couple of things on that flow chart with you you'll see in the right bottom corner there are already exceptions so when you're at you're looking at the database you're trying to decide it there needs to be a business associate agreement I want you to review those exceptions first to make sure hey this is de-identified information so I know I don't need to do that this is from a postal service or some type of mail carrier like FedEx or UPS because those you don't have to have business associate agreements with them I just want you to pay attention to that I'm also looking at this flow chart on the very left hand column at the bottom there's a red box that says a business associate agreement is required well right above that there's a there in that black box right above it it talks about the treatment treatment payment and healthcare operations exception and I want to go under in the this very next slide I want to talk with you about that whenever you are trying to decide whether or not a business associate agreement exists in addition to the exceptions that are listed on the flowchart on the right side you also wanted to pay attention to that box that I was just talking about so on this slide you'll see where there are treatment payment healthcare operations exceptions so if you're providing information to a doctor's office for continuity of care you're serving the same patient no BAA for that if it's if you have a relationship with Medicaid because they're paying for specific services or BlueCross BlueShield you don't need any bas for that or if it's for healthcare operations there are a couple of others on this slide that I do want to note to note because they have come up from time to time and those are janitorial services we do have certain areas within our department where janitors come in after hours our policy is that our protected health information needs to be secured at the end of the day so janitors should not be accessing or have the ability to access our patients client our patient or clients protected health information while they're doing their duties in your area in your county in your office there are certain offices and they've already gotten permission to use daytime housekeeping because the way that they're laid out it's very difficult for them to make sure that that information is secure there have swipe access that type thing and those janitors come during the daytime so that there's an employee to constantly watch and monitor them and so when they leave at five o'clock there shouldn't be anybody that's unauthorized in their unit but as far as the janitorial services go what we do require is that they are we are now requiring that they sign a confidentiality agreement saying that they know that the Department of Public Health has protected health information they know that if they view and wrongfully disclose that information that is a criminal and civil sanction associated with that and that they agreed to keep that information confidential so as it relates to the janitorial services there would be an exception as we discuss the second ago US Postal Service's FedEx UPS anybody that's acting as a carrier for sealed envelopes you know with protecting health information in it you don't need to consider doing a business associate agreement with them and then finally we have the interns and the volunteers now this has come up - what I want to make sure that we understand as a department is that we need to be very careful with who we decide can be an intern or a volunteer for us and the reason for that is when we take on an intern or a volunteer we actually accept them as members of our workforce so just like other employees are able to access certain things and you don't have a business associate agreement with those employees because interns and volunteers are members of our workforce we won't have business associate agreements with them either so if you are looking at entering a contract to UAB for some nursing students that are going to be coming down and they're going to be interning in one of our County Health Department's for a day for a week for a month for a semester we're not going to be getting business associate agreements with them because they're going to be accepted as members of our workforce we also before there's training as we were thinking about preparing for this training I've sent out an email to a number of you who were actually to everybody who at that time had access to the contracts database because we wanted to gauge the pulse of what types of questions do you really have and we were lucky we did get some responses so I want to go over just a few of those questions with you very quickly one of the questions was if you are renewing a contract with the exact same verbage as last year and you are required to have a new are you required to have a new approval letter to go along with the business associate agreement and she says the only thing changing is the effective date and the expiration date of the contract and the BAA so any of you who have gone through the aces database the contracts database and go into the BAA section you'll notice that there's a cover letter the reason for there being a cover letter for me to sign is that when you're initiating at the very beginning when you decide a business associate agreement is necessary if you were to provide that cover letter to me that allows me to know hey there's somebody contemplating a business associate agreement and it allows me to have a conversation with that person to make sure that there's a business associate agreement that there's that there's a business associate relationship because what we don't want to happen is that we just send out mass amounts of business associate agreements that are not appropriate and then it's a bad reflection on the department it looks like we don't understand when a business associate agreement is necessary or when it's not so initially if you're about to engage in a contract and you think that a business associate agreement is necessary I do want you to at least contact me so that I know so that I understand the relationship and I'm helping you think through that process now for this question this is just a renewal of a contract and a BAA that's already in place so both parties already understand that that there's a necessity for a business associate agreement in those circumstances you don't need to worry about providing another cover letter and sending it to me you can provide them the business associate agreement in the same packet that you provide them with the contract and so you don't need to worry about that another question that we had is whether or not a business associate agreement can stand alone or does it always have to be associated with a contract yes you can have a standalone business associate agreement I would say 95% of the time they're gonna be associated with a contract but an example would be if you buy an off-the-shelf product like some type of software and so you don't have a contract but an example that we used about Time Matters which is the software that that the office of compliance and ethics uses and the office of general counsel well we have that product we may have a maintenance agreement but we don't have an ongoing contract about that product but we have a business associate agreement with them so whenever you see where you were you're utilizing a product and they're able to receive maintain and access protected health information to do something on your behalf like with that example it was troubleshooting for us when we had issues with it you want to make sure you have a business associate agreement so yes they can't stand alone the final question that we had had to do with the HIPAA clauses that were in the contract versus a business associate agreement so let me tell you what we have to have both for many of you all that have been around for several years you will remember that with our contracts we used to have five pages worth of HIPAA clauses and you now notice that in the last two years those five pages have been reduced to two paragraphs and the two paragraphs that are in all of our contracts now just state that hey I recognize that there may be an exchange of protected health information and I agree to follow the HIPAA regulations but that's that's pretty much all those hypocrites say so when when there is a need for more you know how you're going to disclose it when you're gonna disclose it when the relationship terminates how are you going to handle a breach all of those things are related to the business associate agreement and so that's why you need to have both and maybe even more important than that in 2013 when the federal regulations change they required us to have business associate agreements in place with entities or individuals that were considered to be business associates of the department so it's actually a federal regulation that we have these business associate agreements our bas in place and those were all of the questions that we have I would encourage you that if after watching this training or over time you find that you have additional questions there's a slide associated with this training that has my contact information on it I'd love to hear from you I think that a number of people who contact our office will note that we try to get back with people as soon as we can generally the same day or the next day I love this stuff so I'm glad to answer these questions and what I want to make sure that you understand is we're not trying to make you into HIPAA experts we only want you to be an expert at your job but we want to make sure that you have the information that you need to make appropriate decisions while you do your job so like I said after after this training if you continue to have questions or if there are great areas that may not have been covered in this training please contact me and let me know and I'll be glad to help you so thank you for tuning in and watching and I look forward to hearing any questions that you might have in the future