What Are Business Associates Required to Do Under HIPAA?

Compliance with the Security Rule: The HIPAA Security Rule is a stringent framework designed to safeguard electronic protected health information (ePHI). It mandates that Business Associates implement comprehensive administrative, physical, and technical safeguards. Medcurity offers an intuitive platform that guides BAs in establishing these safeguards effectively, ensuring the confidentiality, integrity, and security of ePHI.

Breach Notification: Timeliness in notifying Covered Entities (CEs) of any breach of unsecured PHI is critical. The Omnibus Rule stipulates this notification must happen without unreasonable delay and no later than 60 days following the breach’s discovery. Medcurity aids in streamlining this process, offering tools that help in the timely management and notification of breaches.

Use and Disclosure of PHI: The rule is clear that BAs can only use or disclose PHI as permitted by their Business Associate Agreement (BAA) or as required by law, emphasizing the principle of ‘minimum necessary’ use. Medcurity’s BAA management tool ensures that all uses and disclosures are within the agreed terms, safeguarding against unauthorized PHI handling.

Business Associate Agreements (BAAs): The cornerstone of the BA and CE relationship is the BAA, detailing permissible PHI uses and disclosures. Medcurity simplifies this complex process, offering a centralized platform for creating, managing, and storing BAAs, ensuring both compliance and ease of access.

Privacy Rule Requirements: While not all aspects of the Privacy Rule apply to BAs, certain provisions do—via the BAAs. Medcurity helps BAs navigate these waters with educational resources and compliance tools, ensuring they meet their obligations under the Privacy Rule.

Accounting of Disclosures: With the advent of electronic health records, the Omnibus Rule has placed a renewed focus on accounting for disclosures made for treatment, payment, and health care operations. Medcurity provides the necessary tools to accurately track and report these disclosures, fulfilling this critical requirement.

Compliance with HITECH Act Provisions: The incorporation of the HITECH Act into the Omnibus Rule extends specific requirements to BAs, including restrictions on the sale of PHI without authorization and limitations on the use of PHI for marketing and fundraising. Medcurity’s platform is designed to help BAs navigate these provisions, ensuring compliance with both HIPAA and HITECH Act requirements.

Penalties for Non-Compliance: Perhaps one of the most significant changes under the Omnibus Rule is the escalation of penalties for non-compliance. Fines can reach up to $1.5 million per violation category, per year, underscoring the critical nature of adherence. Medcurity’s platform and services aim to prevent such penalties by providing a comprehensive compliance solution.