HIPAA TIP: Business Associate
Contracts Must Be in Place by Apr. 14
[Posted 03/18/04]

The HIPAA privacy rule, which went into effect in April 2003, requires covered physicians to enter into “business associate agreements” with individuals and companies with whom they share their patients’ protected health information, such as billing services, clearinghouses, medical transcriptionists, etc.

The privacy rule contained a grandfather clause, which gave a one-year reprieve for written contracts with business associates that were in place and effective prior to October 15, 2002 (the date the final privacy rule was published).

The reprieve is almost over. These grandfathered contracts must be brought into compliance with the HIPAA privacy rule before April 14.

To download a business-associates-agreement template, see ON-CALL document #1602. ON-CALL documents are free to members at CMA's members-only website. Nonmembers can purchase this and other ON-CALL documents for $2 per page at CMA’s online bookstore. As with all ON-CALL documents, this information is copyrighted and may not be distributed without permission.

The sample agreement—provided by PrivaPlan, CMA’s HIPAA-compliance partner—is just an example of the invaluable information available to physicians on the CMA/PrivaPlan HIPAA Compliance Toolkit CD-Rom. The toolkit contains California-specific forms, policies, and procedures for physician offices to use and follow; a step-by-step HIPAA compliance plan that anticipates likely real-life situations; a list of everyday problems and how to handle them; and other HIPAA training materials. CMA members can purchase the CD-ROM for a special discounted price of $325 (nonmember price is $495).