The Health Insurance Portability and Accountability Act (HIPAA) establishes rules and regulations to safeguard protected health information (PHI). Under HIPAA, covered entities must enter into a Business Associate Agreement (BAA) with their business associates to ensure that PHI is protected.

For those who may not be familiar, a business associate is an individual or organization that performs certain functions or activities involving PHI, on behalf of a covered entity. These activities include claims processing, billing, coding, data analysis, quality assurance, and more.

The BAA is an essential agreement under HIPAA, as it stipulates the terms and conditions between the covered entity and the business associate in regards to PHI. It outlines the responsibilities of both parties and ensures that the business associate complies with HIPAA regulations.

In the past, the BAA was a document that many businesses may have overlooked, but the repercussions of failing to have one in place could be significant. For example, in 2018, Anthem Inc. paid a settlement of $16 million due to a data breach that occurred due to a lack of a BAA with a business associate.

In 2019, updates were made to the BAA as part of the Omnibus Rule. These changes clarified the obligations of both the covered entity and business associate in regard to HIPAA compliance. For example, business associates are now directly liable for HIPAA violations and are required to comply with certain security rules.

If you are a covered entity or a business associate, it is critical to ensure that you are compliant with HIPAA regulations and that you have a BAA in place. Failure to do so could result in significant penalties or a costly breach.

In conclusion, the BAA is an essential aspect of HIPAA compliance that should not be overlooked. With changes to the agreement in 2019, it is crucial to ensure that you are up-to-date with HIPAA regulations and that you have a current BAA in place to protect PHI and avoid penalties.