Business Associates and BAAs
A business associate performs services for a covered entity involving the use or disclosure of PHI. Before HITECH they were bound only by contract; after HITECH, HIPAA privacy and security rules apply directly to business associates, in addition to the required business associate agreement.
How this supports CIPP/US study
Use this lesson to separate sectoral scope, data type and regulated entity before testing an exception. Continue with the CIPP/US practice exam.
A Business associate includes cloud storage providers handling PHI and performs services such as claims processing, data analysis, billing, legal, actuarial, accounting, consulting, and data aggregation. A Business associate agreement (BAA) must be in writing (electronic signature allowed if valid under state law).
Before HITECH, business associates were bound only by their contracts. Under HITECH, HIPAA privacy and security rules are codified and apply directly to business associates - they must implement reasonable safeguards in addition to signing a BAA.
Key terms - quick answers
What is “Business associate”?
What is “Business associate agreement (BAA)”?
Sources and study method
This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.