HIPAA

1.  Definition of agent in relation to Business Associates

Posted 03-20-2017 04:57 PM
When determining the time frame for breach notifications after a breach by a business associate, the regulation states that if the BA is an "agent" of the CE, the CE has 60 days from the date the BA discovered the breach; however, if the BA is not an "agent" of the CE, then the CE has 60 days from the date the BA notifies them.  Can anyone tell me how to decide if the BA is an "agent"?

Thanks in advance for your input!

------------------------------
Kitty Locke BSN RN RAC-CT CHC
Compliance& Privacy Officer
National HealthCare Corporation
Murfreesboro,TN
------------------------------


2.  RE: Definition of agent in relation to Business Associates

Posted 03-21-2017 01:12 AM
Kitty-- You should be able to review or have your legal department review your entity's contract with the BA in question to see how the relationship with the BA is described in the agreement.  Agency relationships are rare given the legal implications of an agency relationship for the covered entity.  You already pointed out one such negative implication related to the discovery date of a breach if the BA were to be an agent of the CE. Hope this helps.   

------------------------------
Mahmood Sher-Jan, CHPC
CEO
RADAR, Inc.
Portland,OR
------------------------------



3.  RE: Definition of agent in relation to Business Associates

Posted 03-21-2017 09:20 AM
Keep in mind that exclusive of what the contract says...you also want to look at other factors that are often considered when determining if an agency (genuine or perceived) may exist.  These include:
- The level of control that is exercised over the contractor.
- How the contractor presents itself to third parties.

These are two good areas to consider.  As posted...generally speaking it is more the exception than the norm that a BA is acting as an agent. Perhaps if you post the function or activity that a particular BA is performing...that may help folks provide feedback if the BA is acting as an agent.

Lastly...to make sure you are on very solid ground...by giving some insight we may also be able to comment whether the contractor is or is not a BA as sometimes people refer to entities as BAs when after review, they are not.

Just some ideas to consider.

------------------------------
Frank Ruelas
------------------------------



'