As CMA members know, the HIPAA privacy rule takes effect on April 14. After that date, members who are covered by HIPAA will no longer be able to send any of their patients’ "protected health information" (PHI) to CMA in the absence of a HIPAA-compliant business associate agreement.

To assist our member in complying with this requirement, and because CMA needs PHI to advocate effectively on behalf of its members with respect to a host of payment and health care operations issues, the CMA Board of Trustees voted that the association be unilaterally bound by a HIPAA-compliant business associate agreement with respect to each of its HIPAA-covered members. Members need not take any further action to make the agreement effective. To download a copy of this agreement, use the link at right.

Pursuant to paragraph 4.01 of this agreement, it will remain in effect only so long as the member physician is covered by HIPAA or remains a member of CMA, whichever is shorter. The terms of this agreement authorize CMA to use, disclose, or request PHI "to assist the physician in obtaining coverage of and payment for services rendered, and to advocate on physician’s behalf with respect to other health care operations issues including, but not limited to, issues involving audits, health plan and IPA bankruptcies, coding and documentation, managed care and other contracts, practice management, credentialing, peer review, and licensing."

More information on business associate agreements is available in ON-CALL document #1602. Members can download ON-CALL documents free at CMA’s members-only website. Nonmembers can purchase this and other ON-CALL documents for $2 per page from CMA's online bookstore.

Contact: CMA’s HIPAA Hotline, 415/882-3311 or legalinfo@cmanet.org.

Previous HIPAA Tips:

HIPAA Tip: Notice of Privacy Practices

HIPAA Tip: FAQ about OHCAs

HIPAA Tip: Chart Cabinets

How Sharp are Your HIPAA Tools?

HIPAA Tip: Security Rule Delay

HIPAA Tip: Sign-In Sheets

HIPAA Tip: Using Patient Names

HIPAA Tip: Using Reminder Postcards

HIPAA Tip: Extension Does Not Apply to Privacy Rule

HIPAA Tip: Inpatient/Outpatient Privacy Notice Requirements Differ

HIPAA Tip: The Extension Deadline Has Passed—Now What?