Navigating and Negotiating HIPAA Business Associate Agreements

Why Should You Attend:

With the changes made to the HIPAA regulations by the Final Omnibus Rule and the Breach Notification Rule, business associate agreements are becoming a significant burden for covered entities and business associates alike. While both parties want to negotiate the most favorable terms possible, it is important to understand which provisions are required by HIPAA and which are for business or liability protection purposes.

In order to reach a satisfactory agreement, it is important for both parties to consider which terms are required and which terms are necessary to their business operations. Both covered entities and business associates also need to consider the nature of their relationship and any underlying agreements when determining which terms are appropriate from an operational or risk allocation standpoint. While certain optional terms may be favorable to covered entities and others favorable to business associates, it is also important for both parties to be able to reach “middle ground” on the business associate terms so that their business relationship can continue in a HIPAA compliant manner.

This webinar will discuss the legal requirements, as well as the real world impact of frequently used optional provisions.

Areas Covered in the Webinar:

• Changes to business associate definitions resulting from the HITECH Act and the Final Omnibus Rule.
• Changes to the business associate agreements.
• Required elements in a business associate agreement.
• Discussion of optional provisions that may be included in a business associate agreement from both the covered entity’s and the business associate’s perspective.
• Discussion of common “sticking points” in business associate agreements and considerations for reaching “middle ground” on these issues.
• Discussion of the Breach Notification Rule and the obligations of covered entities and business associates.
• Discussion of considerations and ramifications related to business associates as “agents” of the covered entity.

Who Will Benefit:

This webinar will provide valuable assistance to all personnel in medical offices, practice groups, hospitals, academic medical centers, insurers, business associates (shredding, data storage, systems vendors, cloud vendors, EHR vendors, billing services, etc). The following titles will benefit from attending this webinar:

• Compliance Director
• Practice Administrator
• CEO
• CFO
• Privacy Officer
• Security Officer
• Information Systems Manager
• HIPAA Officer
• Chief Information Officer
• Health Information Manager
• Healthcare Counsel/lawyer
• Office Manager
• Contracts Manager

Instructor Profile:

Amy K. Fehn, is a partner with the firm of Fehn, Robichaud & Colagiovanni, PLLC, a boutique health law firm in Troy, Michigan. Ms. Fehn has been representing health care providers in regulatory and business matters for over 15 years, including frequent representation of both covered entities and business associates on HIPAA compliance issues. She speaks and writes frequently on the topic of HIPAA Privacy Security.

She is a member of the American Bar Association Health Law Section where she is a Vice-Chair of the Publications committee, a member of the ESource editorial board and participated on the HITECH Business Associate Task Force. She is also a member of the American Health Lawyers Association and the State of Michigan Bar Association Health Law Section, where she participated on the HIPAA Task Force.

Topic Background:

The Final Omnibus Rule changed the definition of business associate and added additional required elements that must be included in compliant business associate agreements. As a result, covered entities are entering into new business associate agreements with their existing business associates and approaching others who were not previously treated as business associates. Many entities who never had to deal with the HIPAA regulations now find themselves in the position of being asked to sign business associate agreements.

The Breach Notification Rule, as amended by the Final Omnibus Rule also created new responsibilities for both covered entities and business associates, the allocation of which must be agreed upon and addressed in the business associate agreement.

The negotiation of these terms can take considerable time, especially when the parties do not agree on the required elements. In order to effectively negotiate business associate agreements, both covered entities and business associates must understand which terms are required for HIPAA compliance and which terms are necessary to protect their business from liability or other risks.

Follow us :