HIPAA

BAA Template for Third-Party Vendor for Diabetic Counseling Services

  • 1.  BAA Template for Third-Party Vendor for Diabetic Counseling Services

    Posted 05-21-2020 07:50 AM
    Colleagues,

    I need your help.  I have a standard BAA format that we use for our primary healthcare providers, including our wellness support vendor.  One of their subcontractors provides diabetic counseling services to our employees and from my HIPAA/HHS research, I believe it would be a good idea to have a BAA with that subcontractor as well.

    Does anyone have a BAA template that they would like to share that you use for a subcontractor for one of your primary providers?  Better yet, one that you use for any type of counseling services?  Many thanks and have a great Memorial Day weekend!

    ------------------------------
    Kent Swagler
    Director, Corporate Compliance and Ethics
    BiState Development
    St Louis,MO
    kwswagler@bistatedev.org
    (314) 923-3097
    ------------------------------
    19th Annual CEI Virtual Conference


  • 2.  RE: BAA Template for Third-Party Vendor for Diabetic Counseling Services

    Posted 05-21-2020 08:33 AM
    Kent, 

    I don't want to make a commitment here as you did not provide a lot of information about teh relationship between your organization and the contractor/subcontractors. But, are you sure that business associate is the correct description for how the practices interact. 

    A business associate provides services to the covered entity that requires access use or disclosure of PHI in the custody of the covered entity. The services provided are a benefit to the covered entity. In many cases, when a practice assists a patient is acquiring services for an outside source that source is a covered entity, not a business associate. 

    The classic example here is a reference lab. The covered entity may collect and prepare the sample and report the results to the patient. However the work provided by the lab is a benefit to the patient, not the practice ordering the test. 

    Now one of the reasons we have lawyers (and not only am I not one but I am not qualified to even consider playing one on TV) is because there are all sorts of nuances used to determine to whom the benefit is provided. So before changing anything I would recommend seeking competent legal advice. 

    I know this does not answer your immediate question but as you get a few extra moments in your work day  reevaluating those outside relationships may ultimately simplify you efforts moving forward. 

    Even though it is not an answer, I hope it is useful. Just my opinion, not legal advice. 

    Good Luck 
    -Alex-
    Alexander I Slosman, MHA, CHC, CHPC



    19th Annual CEI Virtual Conference


  • 3.  RE: BAA Template for Third-Party Vendor for Diabetic Counseling Services

    Posted 05-21-2020 08:35 AM

    Kent,

    If I'm understanding correctly, I don't believe you need a BAA with your Business Associate's sub-contractor.  Your Business Associate should have a BAA with their own sub-contractor.

    Cinda

    ******************************************* This message and any attachments to it may be confidential and are intended solely for the use of the individual to whom it is addressed. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.



    19th Annual CEI Virtual Conference


  • 4.  RE: BAA Template for Third-Party Vendor for Diabetic Counseling Services

    Posted 05-21-2020 08:52 AM
    Agreed...as shown in the graphic.   I see most folks follow what is described in the regulations where there is a BA between the CE and the 1st level BA...a BAA between the 1st level BA and 2nd level BA...and so on.

    Now...there's nothing wrong or to prevent a CE from having a BAA in place with a downstream BA, particularly if there may be some concerns, issues, risk areas, etc where the CE may wish to have a BAA in place...but certainly not required.



    ------------------------------
    -------------Frank "Snake Bite Leader" Ruelas--------------
    ► We don't fail unless we quit! ◄
    Bill Wong's Resource Folder: https://bit.ly/BillWong
    Super Summer Slam Study Squad sign up: www.surveymonkey.com/r/TP5MY5P

    ░ Pass the Exam Group for 2020 ░
    Melissa Singleton - Jan - CHPC
    Julie Clutter - Jan - CHPC
    Tanisha Grant - Feb - CHC
    Lisa Bibby - Jan - CHPC
    Kelly Puida - Mar - CHPC
    Christina Serrano - Mar - CHC
    Rachel Anderson - May - CHC
    ------------------------------

    19th Annual CEI Virtual Conference


  • 5.  RE: BAA Template for Third-Party Vendor for Diabetic Counseling Services

    Posted 05-21-2020 09:12 AM
    Frankl,

    I have to, sort of,of disagree, but in application not in fact. What I mean is:
    If a covered entity uses an business associate (BA1), and BA1 uses a sub contractor (BA2) we know the CE must have a BAA in place with BA1. 

    Additionally as you and Cinda mentioned BA1 must have a BAA in place with BA2. 

    However, the existence of the original BAA between the CE and BA1 does not provide a safe harbor to the CE for issues regarding BA2. The CE is still responsible to taking reasonable steps to ensure there is a  BAA between BA1 and BA2 and that BAA is both effective and enforced.

    In the past 18 months or so we have seen 2 or 3 cases where OCR took enforcement action against CEs for not ensuring   the subcontractor BAAs were in place and enforced.    

    Alexander I Slosman, MHA, CHC, CHPC



    19th Annual CEI Virtual Conference