Jason Throckmorton (throckmj@somc.org) is Information Security Auditor at Southern Ohio Medical Center in Portsmouth, OH.

Managing business associates and keeping track of the business associate agreements that come with them is part of the Health Insurance Portability and Accountability Act (HIPAA) compliance process. Tracking those business associate agreements (BAA) can be a tiresome journey if you do not have sole control over their issuance. However, with some organizational measures, you can turn this into a manageable task.

By law, the HIPAA Privacy Rule applies only to covered entities — health plans, healthcare clearinghouses, and certain healthcare providers. However, most healthcare providers and health plans do not carry out all of their healthcare activities and functions by themselves. Instead, they often use the services of a variety of other persons or businesses. The Privacy Rule allows covered providers and health plans to disclose protected health information (PHI) to these “business associates” if the providers or plans obtain satisfactory assurances that the business associate will use the information only for the purposes for which it was engaged by the covered entity, will safeguard the information from misuse, and will help the covered entity comply with some of the covered entity’s duties under the Privacy Rule.^[1]

The Privacy Rule requires that a covered entity obtain satisfactory assurances from its business associate that the business associate will appropriately safeguard the PHI it receives or creates on behalf of the covered entity. The satisfactory assurances must be in writing, whether in the form of a contract or other agreement between the covered entity and the business associate.^[2]