Managing business associates across their full lifecycle

Know who your business associates are

A business associate is a person or entity that creates, receives, maintains, or transmits PHI on behalf of a covered entity. Billing services, cloud and IT providers, shredding companies, consultants with record access, and many software vendors qualify. The first control is an inventory: every vendor, classified by whether it touches PHI.

The four stages

1. 1
   Intake

   ·Tier by PHI exposure, system access, and criticality

   ·Security assessment
2. 2
   Contracting

   ·Execute the BAA

   ·Set a breach-reporting window, often 24 to 72 hours
3. 3
   Monitoring

   ·Annual re-assessment

   ·Review SOC 2 reports and questionnaires
4. 4
   Offboarding

   ·Revoke access

   ·Certify return or destruction of PHI

Before signing

Assess the vendor’s safeguards in proportion to the PHI it will handle: questionnaires, certifications such as SOC 2 reports, and incident history. Record the assessment and the decision. HIPAA requires satisfactory assurances, documented in the BAA. A security assessment is not itself required by the rule, but it supports your risk analysis and shows due diligence.

The agreement

Among other required terms, the BAA must establish permitted uses and disclosures, require appropriate safeguards, require reporting of breaches and security incidents, flow obligations down to subcontractors, support access, amendment, and accounting of disclosures, make records available to HHS, and address return or destruction of PHI at termination. Track the execution date, the breach-reporting period the vendor agreed to, and the renewal or review date.

During and after

Reassess on a cadence tied to risk, and whenever the vendor’s services or subcontractors change. At termination, obtain and retain certification that PHI was returned or destroyed. When a regulator asks for a list of business associates, the answer should be one export that includes each agreement and its status.

Closing the loop

Is it working?

Every vendor that handles PHI has a current agreement, an owner, and a review date.

Can you show it?

Produce the business associate list with each agreement, its status, and the most recent assessment.