URGENT – January 25, 2013 Deadline For Business Associate Agreement Review
The recently adopted final regulations on the HITECH Act contain an urgent deadline that providers need to begin addressing TODAY!
Tomorrow is the deadline under the Final HITECH Regulations to verify that you have signed Business Associates Agreements in place with all necessary parties. The Final HITECH Regulations provides for a grandfathering of existing Business Associates Agreements until September 23, 2014. The original deadline for upcoming Business Associate Agreements to comply with HITECH was September 23, 2013 but the Final HITECH Regulations extend that date for one year for grandfathered Business Associate Agreements. In order to qualify for grandfathering of Business Associate Agreements, the agreement must be in place by Friday, January 25, 2013.
The requirement applies to all “covered entities” under HIPAA. If you are a health care provider, you are a covered entity. It also applies to subcontractors of parties who are “business associates” of health care providers.
Parties may continue to rely on grandfathered Business Associates Agreements (entered before January 25, 2013) until September 23, 2014 unless they expire or are modified sooner. Grandfathered agreements are deemed to comply with the revised rules regarding Business Associates Agreements found in the Find HITECH Regulations issued last week.
Providers should review the outside parties that they contract with and ensure that they have Business Associates Agreements in place by the end of business January 25, 2013 if they wish to ensure that those agreements are deemed to meet federal regulations. You will also need to be aware of any such agreements that expire by their terms or are modified between now and September 23, 2013. Agreements that terminate or are modified within that time frame will need to meet the new standards upon modification or termination (assuming that the business relationship continues). If the Business Associates Agreement contains an automatic term rollover provision that extends it past September 23, 2014, it will meet the grandfathering requirement.
Many healthcare providers have already updated their Business Associate Agreements to comply with the new HITECH standards. However, many have not gone back to audit whether their existing agreements comply with the new law or whether all agreements are in place that need to be.
There are significant compliance gaps with between Business Associates and their subcontractors. A Business Associate who has potential access to PHI and subcontracts any portion of its obligations, must ensure that a Business Associate Agreement is in place with each subcontractor. Many subcontractors are not even aware that they have this obligation and should take this time to perform a compliance audit review of their subcontracting relationships.
If you need any assistance with respect to the review of your Business Associates Agreements or processes, please feel free to contact our offices.