HIPAA Security Rule & Business Associates

Overview

The Health Insurance Portability and Accountability Act (HIPAA) Security Rule establishes national standards to protect individuals' electronic personal health information (ePHI) that is created, received, used, or maintained by a covered entity. It requires appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and security of ePHI.

A critical aspect involves managing "Business Associates" – third parties performing functions involving the use or disclosure of PHI on behalf of a covered entity. Covered entities must ensure their business associates comply with HIPAA safeguards.

Status

Active - Final Rule effective April 2003 (modified by HITECH Act)

Jurisdiction

United States

Regulatory Authority

Department of Health and Human Services (HHS), Office for Civil Rights (OCR)

Applicability

Covered Entities (health plans, clearinghouses, providers) and their Business Associates

Business Associate Agreements (BAAs)

The cornerstone of managing third-party risk under HIPAA

Mandatory Contracts

Covered entities are required to enter into a formal, written contract or other arrangement – a Business Associate Agreement (BAA) – with their business associates before any PHI can be shared. This agreement is legally binding and outlines the responsibilities of both parties regarding PHI protection.

Key BAA Provisions

Establish permitted and required uses/disclosures of PHI by the BA.
Require the BA to implement appropriate safeguards (administrative, physical, technical) compliant with the Security Rule.
Require the BA to report breaches of unsecured PHI, security incidents, and unauthorized uses/disclosures to the covered entity.
Ensure BA extends the same protections to its subcontractors that access PHI.
Require BA to make PHI available for access, amendment, and accounting of disclosures per HIPAA Privacy Rule.
Obligate the BA to return or destroy all PHI upon termination of the contract, if feasible.
Authorize termination of the contract by the covered entity if the BA violates a material term.

Covered Entity Responsibilities for BAs

Beyond the BAA, covered entities have ongoing duties

Due Diligence

Perform due diligence to obtain "satisfactory assurances" that the business associate can appropriately safeguard PHI before entering into a BAA.

Action on Non-Compliance

If aware of a material breach or violation by the BA, the covered entity must take reasonable steps to cure the breach or end the violation. If unsuccessful, terminate the contract.

Ongoing Relationship Management

Implicit expectation to manage the relationship, though HIPAA doesn't explicitly mandate ongoing monitoring beyond acting on known violations.

Key Security Rule Safeguards (Applicable to CEs & BAs)

Core security measures required by the HIPAA Security Rule

Administrative Safeguards

Policies, procedures, and actions to manage security measures and workforce conduct.

Security Management Process (Risk Analysis, Risk Management)
Assigned Security Responsibility
Workforce Security & Training
Information Access Management
Security Incident Procedures
Contingency Planning (Backup, Disaster Recovery)
Evaluation (Periodic Assessments)
Business Associate Contracts

Physical Safeguards

Measures to protect electronic systems, equipment, and data from physical threats.

Facility Access Controls
Workstation Use Policies
Workstation Security
Device and Media Controls (Disposal, Re-use, Backup)

Technical Safeguards

Technology and related policies/procedures to protect ePHI and control access.

Access Control (Unique User IDs, Emergency Access)
Audit Controls (Record/examine activity)
Integrity Controls (Protect against improper alteration/destruction)
Person or Entity Authentication
Transmission Security (Encryption)

Additional Resources

Official HHS and OCR guidance on HIPAA Security and Business Associates

HIPAA Security Rule Text

Official text of the Security Standards for the Protection of ePHI.

Access Rule

Business Associates Guidance

HHS guidance on Business Associates, including sample BAA provisions.

Access Guidance

Security Rule Guidance Material

Detailed guidance materials covering various aspects of the Security Rule.

Access Materials

HHS Security Risk Assessment Tool

A tool to help organizations conduct risk assessments required by HIPAA.

Access Tool

Tools for HIPAA BA Management

Solutions to streamline Business Associate Agreements and compliance

BA Inventory & Tracking

Centralized system to manage all business associates and their BAA status.

BAA Template & Workflow

Standardized BAA templates and automated workflows for execution.

Due Diligence Questionnaires

Customizable security questionnaires to assess BA compliance.

Compliance Monitoring

Tracking BA attestations, certifications, and incident reports.

Audit Support Documentation

Easy access to BAAs, due diligence records, and compliance evidence.

BAA Renewal Management

Automated reminders and workflows for periodic BAA reviews and renewals.

Cyber Score

HIPAA Security Rule and Business Associates