Advanced Issues in Business Associate Contracting Alice J. Becker, JD Senior Associate General Counsel PeaceHealth Bellevue, WA abecker@peacehealth.org Rebecca L. Williams, RN, JD Partner Davis Wright Tremaine LLP Seattle, WA beckywilliams@dwt.com Davis Wright Tremaine LLP

Two Sides to Every Contract Covered entity Has obligation to enter into contract Often want added assurances Business associate If business associate wants to work with health care or insurance industries, must contract May be a covered entity Battle of the Forms

Comparison of HIPAA Contracts Chain of Trust Agreement Now Eliminated in Final Security Rule Trading Partner Agreement Transaction & Code Set Rule Business Associate Contract Privacy and Security Rules Data Use Agreement Privacy Rule (for use with limited data sets) Contracts may be combined as appropriate, such as Clearinghouses may require Trading Partner –BAC Combo BA who creates limited data sets

A Short Overview — Who is a Business Associate? A person who, on behalf of a covered entity or OHCA — Performs or assists with a function or activity involving Individually identifiable information, or Otherwise covered by HIPAA Performs certain identified services Auditors, Actuaries Billing Firms Lawyers Clearinghouses TPAs Covered Entity Management Companies Consultants, Vendors Accreditation Organizations

Business Associate Contracts — Required Terms Under Privacy Rule Use and disclose information only as authorized in the contract No further uses and disclosures Not to exceed what the covered entity may do Implement appropriate safeguards Report unauthorized disclosures to covered entity Facilitate covered entity’s access, amendment and accounting of disclosures obligations Allow HHS access to determine CE’s compliance Return/destroy protected health information upon termination of arrangement, if feasible If not feasible, extend BAC protections Ensure agents and subcontractors comply Authorize termination by covered entity

Business Associate Contracts —Required Terms Under Security Rule Implement administrative, physical and technical safeguards that reasonably and appropriately protect the Confidentiality, Integrity and Availability of electronic protected health information Ensure any agent agrees to same restrictions Report any security incident Authorize termination if the covered entity determines business associate has breached When to implement? Now? 2005?

Limited Data Set — Not Quite De-Identified LDS = PHI that excludes direct identifiers except: Full dates Geographic detail of city, state and 5-digit zip code Not de-identified Special rules apply

Data Use Agreements A CE may use or disclose a limited data set for research, public health or health care operations if recipient signs data use agreement Required Elements: Establish permitted uses and disclosures by recipient Establish who is permitted to use or receive limited data set Require recipient to: Not further use or disclose information Use appropriate safeguards Report impermissible use or disclosure Ensure agents comply Not identify the information or contact the individuals Beware of state law twists

Transition Provisions Covered entities may continue existing contracts for up to one year beyond April 14, 2003 Existing contract prior to effective date of final amendment Contract not renewed or amended between October 15, 2002 and April 14, 2004 Covered entity still required to comply with Privacy Rule

PeaceHealth — An Organizational Challenge 3 states (Oregon, Washington and Alaska) 6 hospitals Outpatient clinics, nursing home, EAPs, home health, hospice, retail pharmacies, laboratories Self-insured health plan

PeaceHealth Identification Process Security and Privacy Oversight Committee (“SPOC”) Regional contract coordinators Education and training Website information Agreements normally subject to Legal Department review Ignore “extension”

Contract Process — PeaceHealth Forms Template Business Associate documents Existing, new, and no written agreement Incorporate security requirements — no separate agreement Incorporate state law requirements (patient rights) Other template agreements with business associate provisions embedded (e.g., medical director agreements) New agreements — add templated language (e.g., transcription agreements) Negotiations — PeaceHealth does not insist on non-required provisions

Contract Process — Third Party Forms Examples — “large vendors” (e.g., Siemens, Premier, IDX, Xerox) to accreditation entities (e.g., CAP) Educate PeaceHealth to send to Legal Department Avoid battle of the forms: Agree to form if tracks the rule Don’t agree to non-required provisions, e.g., OCR language Check for state law compliance Allow each region to sign own form, i.e., JCAHO

PeaceHealth Approach as Business Associate All third party documents must come to Legal Department PeaceHealth templated agreements Include minimum requirements

Issues in Negotiations Covered entity obligations listed in OCR language Notice to BA No nonpermissible requests Obligation to notify BA of changes to NPP or PHI Requirement to mitigate on business associate CE has duty to mitigate under HIPAA Would want assistance from BA Not required

Issues in Negotiations Indemnification Insurance Right to review contracts between business associates and their subcontractors/agents Right to inspect/investigate/audit Ownership of information Change in law Agree to negotiate amendments Unilateral amendments No third-party beneficiaries Beneficial to both parties

Issues in Negotiations Termination provisions Right to immediately terminate Cure periods Authorized to terminate Absence of termination provisions Reference back to underlying contract Unilateral approach

Issues in Negotiations Whistleblower provision 45 CFR Section 164.502(j)(1)(i) De-identification of PHI Don’t meet state law timeframes/obligations Challenges to relationship Treatment only? OHCA?

Issues in Negotiations Data Use Agreement Detailed v. simple Correct purposes? Public Health Health Care Operations Research Underlying agreement Review scope of use Is it a limited data set? Check State Law

Miscellaneous Issues Medical staff — “PeaceHealth OHCA” Board members Removes need for business associate contract Board members Institutionally related foundations Registries Services to PeaceHealth/BAC Authorized by law Accounting of disclosures Equipment maintenance Medical devices FDA reporting May be providers

Miscellaneous Issues Volunteers Expert witnesses Lean and mean contract Do experts need a BAC or Second Tier BAC/subcontractor agreement? EAP agreements Plan sponsor requirement or No disclosure of PHI What about non-applicable provisions? Shredders

FAQs Between providers for treatment Third party payors “Conduits” (couriers, mail services and electronic equivalents) Janitorial services Organ and tissue procurement contracts

Questions