Skip Navigation

Revised HIPAA business associate agreement now available

Bookmark and Share

In February 2009, the Health Information Technology for Economic and Clinical Health (HITECH) dramatically altered HIPAA. As a result of many of the changes to HIPAA and HITECH, most notably breach notification requirements, the law itself required the revision of all HIPAA business associate agreements (BAA).

NAID immediately responded by creating a revised agreement to address all the known changes. To make the revisions, the association turned to attorney Kirk Nahra, arguably the most highly regarded legal authority on HIPAA and HITECH.

Fast forward four years and, after many delays, the U.S. Department of Health and Human Services (HHS) issues the HITECH Final Rule in February 2013. Again, NAID consulted Nahra for revisions. Effective immediately, the NAID sample HIPAA BAA and subcontractor BAA have been updated to reflect the new requirements of the HITECH Final Rule.

Any member using the NAID sample BAA should request the revised version (April 8, 2013) for future use from this point forward. Those members who have been using the version revised in April 2009 are not required to go back to those customers and update their contracts with this newer version. The changes are not substantive enough to put the member or the covered entity at risk. 

Keep in mind, the obligation to have a BAA in place lies with the covered entity, not the service provider. That said, many NAID members provide this contract as part of their service in order to protect their HIPAA clients. Service providers, however, are legally obligated under HITECH to execute a subcontractor BAA with any downstream service providers.

Under HITECH, all HIPAA BAA’s currently in place must be revised by September 2014. This does not apply if there is no BAA in place, in which case, the BAA should be put in force as soon as is reasonably possible. To request any of the NAID sample industry contracts, members in good standing must submit the NAID Standard Contract Release Form.