Health information and business associate terms: the clause the question tests
Whether the supplier will take on business associate duties for health information.
How the customer usually asks it
example"Will you sign a business associate agreement for the protected health information we share?"
Anchor clauses
1 framework| Framework | Anchor clause |
|---|---|
| HIPAA Security Rule (45 CFR 164) | 164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard) · 164.314(a)(1) Business Associate Contracts or Other Arrangements (Standard) |
Every framework that anchors this family is listed here; a register shows the ones ticked for the customer.
Evidence expected
The business associate agreement terms the supplier will sign, and the safeguards that apply to protected health information in the service.
The clauses, with what an assessor asks for
HIPAA 164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard)A covered entity may permit a business associate to handle ePHI only after obtaining satisfactory assurances via written contract. NIST recommends due diligence, security questionnaires, and ongoing monitoring of BAs.
Where answers usually fall short: BA inventory incomplete; BAAs missing for cloud vendors
Source: HIPAA Security Rule (45 CFR 164)
HIPAA 164.314(a)(1) Business Associate Contracts or Other Arrangements (Standard)The contract or other arrangement required by 164.308(b)(3) must meet the requirements of paragraph (a)(2)(i), (a)(2)(ii), or (a)(2)(iii) of this section, as applicable.
Where answers usually fall short: Older BAAs missing post-Omnibus requirements; Government arrangements undocumented
Source: HIPAA Security Rule (45 CFR 164)