HIPAA Business Associate Agreements - 7 Things To Know Before The HITECH Deadline

Shannon Hartsfield Salimone is a Partner in Holland & Knight's Tallahassee office.

Covered entities and business associates have only until September 22, 2014 to update business associate agreements that were in place as of January 25, 2013. For those members of the health industry and their vendors that are still working to update these agreements, here are seven things to remember:

1. Noncompliant agreements: If covered entities and business associates still continue to exchange protected health information (PHI) after the deadline without a compliant agreement, they would arguably be using or disclosing PHI in a manner not permitted by the HIPAA Privacy Rule. Therefore, such access, use, or disclosure of PHI is presumed to be a breach unless the covered entity or business associate demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment of at least the four factors listed in 45