BAAs comply with both HIPC rules and the obligation of liability between the two parties. If one party violates a BAA and discloses PHI, the other party has a lawsuit. If there is no BAA, if it is incomplete, or if the agreement is blatantly violated, both staff members may be in the crosshairs of the Department of Health and Human Services, the Office of Civil Rights, and perhaps even the Department of Justice. (4) Application specifications: other requirements for contracts and other agreements. (i) The contract or other agreement between the covered entity and the counterparty may allow the counterparty to use, where appropriate, the protected health information that the counterparty receives in its capacity as counterparty to the classified entity: prohibit the counterparty from continuing to use or disclose the protected health information for purposes other than those specified in the contract. As described above, BAAs are entered between HIPAA covered entities and HIPAA business partners. They are also seized between HIPAA counterparties and their subcontractors (who are also CONSULTANTSHIPAA counterparties under HIPAA rules). Although three-party agreements are not required under the rules, covered companies sometimes require subcontractors of their counterparties to enter into tripartite agreements in order to create a contractual nature between the covered entity, the counterparty and the counterparty`s subcontractor. The HIPC requires that a covered entity be obliged to enter into a HIPC-compliant counterparty agreement with all of its counterparties. In addition, all counterparties must enter into HIPAA-compliant subcontracting agreements with subcontractors who perform certain functions and have access to the covered entity`s PHI. See also www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html and www.hhs.gov/hipaa/for-professionals/faq/business-associates.9, Title 45, Chapter 164, Subsection E of the Code of Federal Regulations.10, Title 45, Chapter 164, Subsection C of the Code of Federal Regulations.11, Title 45; Chapter 164, Subsection D of the Code of Federal Regulations.12 See 45 CFR 164.524.13 See 45 CFR 164.526.14 See 45 CFR 164.526.14 See 45 CFR 164.528.
. . .