Business Associate (HIPAA) Subcontractor Agreement will solidify the confidentiality and responsibilities that a Contractor and Subcontractor expect from one another when their working relationship will fall under the auspices of the Health Insurance Portability And Accountability Act Of 1996. Generally, this agreement is a precautionary tool that will verify each Party’s knowledge of their obligations in terms of this statute. Both the Contractor and Subcontractor should make sure they are up-to-date in their knowledge of this act (HIPAA) and should make sure to fully comprehend this agreement before signing it. It is recommended that both the Contractor and Subcontractor retain a signed copy of this agreement for their records once it has been executed.


“Subcontractor” Definition (45 CFR § 160.103) – “Subcontractor means a person to whom a business associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate.”

Laws – 45 CFR Part 160 and Part 164, Subpart A and Subpart E.

Is a Business Associate Subcontractor Agreement Required?

Yes. According to 45 CFR § 164.314, a business associate that enters into an arrangement where protected health information is being shared electronically, also known as ‘electronic protected health information’ or ‘ePHI’, a subcontractor agreement is required.

Glossary (Definitions)

Business Associate (45 CFR 160.103) – “Business associate includes: (i) A Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect to protected health information to a covered entity and that requires access on a routine basis to such protected health information, (ii) A person that offers a personal health record to one or more individuals on behalf of a covered entity, (iii) A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.”

Covered Entity (45 CFR 160.103) – “Covered entity means: (1) A health plan, (2) A health care clearinghouse, (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.”

Health Care Provider (45 CFR 160.103) – “A provider of medical or health services (as defined in section 1861(s) of the Act, 42 U.S.C. 1395x(s)), and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business.”

HIPAA (Public Law 104-191 – PDF Version) – Health Insurance Portability and Accountability Act

Protected Health Information (PHI) (45 CFR 160.103) – “Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) Protected health information excludes individually identifiable health information: (i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv); (iii) In employment records held by a covered entity in its role as employer; and (iv) Regarding a person who has been deceased for more than 50 years.”

How to Write

Download: Adobe PDF, Microsoft Word (.docx)

1 – Save The Business Associate HIPAA Subcontractor Agreement From This Page

The paperwork displayed in the window on this page can be acquired by selecting either the “PDF” or “Word” button displayed. You may open this form with your browser, but it is recommended that you download it for future use. It is also suggested that you make sure you have a software environment that can input information directly to the file you download if possible.

2 – Establish This Agreement’s First Date Of Effect And The Parties Entering It

This document will only function correctly if the calendar date that applies to it is attached to the Parties who wish to work with each other through this paperwork. Therefore, enter the calendar month and two-digit day for this paperwork on the blank space following the wording “…Is Made Effective” in the first paragraph. Make sure to also record the corresponding year for this date on the second blank line.    Next, present the full name of the hiring entity intending to employ the Subcontractor on the line preceding the parentheses label “(Business Associate).”              Finally, the Subcontractor’s legal name must be placed on the line labeled “(Business Associate Subcontractor).” This is the Subcontractor who will be hired by the Business Associate as of the calendar date you reported.

Both entities must read this document in its entirety to full comprehension. The final statement of this contract will seek to verify precisely when both parties formally obligate themselves to its contents. Find the capitalized words “In Witness Whereof…” near the end of the of this agreement, then use the two blank spaces this statement contains to record the month, two-digit calendar day, and year of this contract’s effective date.

 

3 – An Executing Signature From Each Party Is Mandatory To Complete This Paperwork

There will be two columns at the end of this document where both Parties will declare their intentions by signature. The “Business Associate” column will present three blank spaces labeled “Signature,” “Print Name,” and “Date.” Here, the Owner or Representative of the business hiring the Subcontractor must sign his or her name, print his or her name, and record the calendar date of signature on these lines.      The “Business Associate Subcontractor” column is reserved for the Subcontractor to officially enter this contract. This will require that the Subcontractor sign his or her name on the “Signature” line then print his or her name below it. The last item in this column requests the date when these items were provided.