HIPAA to the BA

Today's issue is HIPAA and Business Associate Agreements.

Under the HITECH Act, HIPAA will apply to Business Associates like it currently applies to Covered Entities. There is a proposed rule to implement this, which was expected to be finalized this past summer. It was not.  If Obama wins, there is no telling when the final rule will be issued.  If he loses, it is a safe bet that his regime will push to have the final rule issued before the end of the year in order to forestall its complete death.

The key to these proposed rules is that Covered Entities are trying to build in the elements of the proposed rules to their current Business Associate Agreements.  At present, certain elements are not expected out of Business Associates, but certainly Covered Entities would love to have these elements present now - like downstream enforcement to subcontractors of the Business Associates, audit trails, and the physical, administrative, and technical safeguards of the security rule.

There is a hope and a prayer that reasoning will overcome our Congress and some pieces of the HITECH Act will get repealed. But it's only a hope. and LOTS of prayer.