Header graphic for print
Inside Privacy Updates on Developments in Global Privacy & Data Security from Covington & Burling LLP

HITECH Update #10: HHS Releases First Sample Business Associate Agreement Provisions Since HITECH Act, Omnibus Rule

Posted in Health Privacy, United States

This post is part of our series on key aspects of the final HITECH omnibus rule published by the U.S. Department of Health and Human Services (HHS) in the Federal Register on January 25, 2013. Previous posts are available here. The regulations are effective March 26, 2013, but covered entities and business associates have until September 23, 2013, to comply with most new requirements.

The Department of Health and Human Services (“HHS”) recently published sample business associate agreement provisions that reflect new requirements in the final HITECH omnibus rule.  The sample provisions are available here.  As we previously wrote, the omnibus rule requires covered entities and business associates to add several new provisions to their business associate contracts.  In order to comply with these new requirements, covered entities and business associates should review existing agreements and ensure that future agreements account for the new requirements.