First Healthcare Compliance CONNECT September 2022

subcontractor. All of that is exceptionally important.
So just something to be conscientious about
there. Then you delve into the three overarching
areas or purposes behind the Business Associate
Agreement to ascertain that both parties each
have been given reasonable assurances that the
technical, administrative, and Physical Safeguards,
as well as the privacy rule, security rule and Breach
Notification Rule, and compliance and requirements
are being met.
Another item that relates to that now is the 21st
Century Cures Act in the ability to give patients their
medical records in formats such as smartphone
apps that weren’t necessarily available before but
along with that related to information blocking, are
situations where a provider or a business associate
may say, what the general rule is that we have to
provide this, but this is not an app that is secure
or that we’re familiar with and for the safety of the
entity and for structure, we’re not going to provide
that. So it’s important now to reference state laws
and other relevant laws such as a 21st Century
Cures Act.
The next main area, has to do with notification
to the other party if you have a reportable cyber
security incident, typically known as a breach, in
accordance with the Breach Notification Rule. And
there are really two steps to that. First, you want to
have a timeframe set out between the parties as to
when party A, if they’re the breaching party, has to
notify party B, that there has been a breach. That’s
important because their IT department needs to
take appropriate steps in order to safeguard certain
things or go to plan B to go to backups. So it’s really
mutual in nature along those lines. And then the
second part of a reportable breach would then be
under the Breach Notification Rule, to report to HHS
to report to the patients and to report to the media if
the breach itself affects 500 individuals or more.
Can you explain reasonable
assurances in relation to business
associate agreements and HIPAA?
Reasonable assurances in HIPAA is the first part of
the business associate aid agreement. Both parties,
giving assurances that they meet the technical,
administrative and physical safeguards in order to
ensure the confidentiality, integrity and availability
of the data. What would give someone peace of
mind and also give them something legally, that
they could say, what we know that we do not have
a right to go in and inspect everything. I have seen
situations where, given the size of the contract, or
the particular service that was at stake, sometimes,
one entity will agree to let another entity come on
site and view their operations, which is only one
part of that. What I do is I have my clients get a
signature on an attestation. And the purpose behind
it is that these reasonable assurances are being
provided in order to give peace of mind that the
party is adhering to the requirements of HIPAA in
the HITECH Act. And if people can answer these
five questions in earnest, you should walk away
with a good feeling that they’re doing everything
that needs to be done. The first question is, does
the party undergo an annual risk analysis that
is comprehensive? Second, do they train their
workforce annually? Third is PHSI insensitive PII
encrypted both at rest and in transit? Fourth, are
business associate agreements in place, and
are they recorded? And lastly, are policies and
procedures at least reviewed annually, and are they
comprehensive? So with that, that is a how I define
and think of a reasonable assurance? And secondly,
how I advise my clients to protect themselves. And
then lastly, the types of reasonable assurances are
those five that I honed in on?
What are indemnification provisions
and what language should be used in
indemnification provisions?
It’s typically thought of as a contractual obligation
of one party to compensate the loss incurred to the
other party, due to certain acts of the indemnitor or
any other party, the duty to indemnify is usually but
not always, coexisting with the contractual duty to
Contact Toll Free: 888-54-FIRST 9