Business Associate Agreements and Addendum Procedures

Human Resources | Safety/Security | Research Compliance | Compliance | Privacy/Information Security | Business Operations | Intellectual Property

Compliance Program | Compliance Hotline | Investigations by Third Parties | Research Integrity | Export Control | Code of Conduct | Use of Human Anatomical Material | Clinical Trial Fee Billing Procedures | Contracts | Conflict of Interest | Red Flag Identity Theft Prevention Program | Principles of Financial Stewardship | Human Tissue Use and Transfer | International Research Policy | Health Care Vendor Interactions | Internal Audit

Business Associate Agreements and Addendum Procedures

NOTE: These guidelines are provided to assist UNMC workforce, including those in the patient treatment areas of the Munroe-Meyer Institute, the College of Medicine Optical Shop, the Lions Eye Bank and the College of Dentistry, as applicable, comply with HIPAA regulations. Those departments and clinics which fall under the jurisdiction of The Nebraska Medical Center and/or University Medical Associates should consult the policies and procedures of those entities for authoritative guidance.

Please see: UNMC Policy No. 8009, Contracts

Procedure

1. Departments are required to complete a Business Associate Agreement or Business Associate Addendum whenever vendors provide services on behalf of UNMC and have access to protected health information.
2. Healthcare providers providing patient care are exempt from the requirement.
3. Business Associate Agreements and Addendums are required for all new or modified contracts for services after October 13, 2002. Existing contracts require Business Associate Agreements or Addendums by April 15, 2005.
4. Business Associate Addendums are utilized whenever a formal contract is in place for the services being provided. The Addendum reinforces the services that have been specified in the contract and outlines the protected health information.
5. Business Associate Agreements are required whenever services are being provided and a formal contract has not been executed. In this case the Business Associate Agreement will outline the services being provided and the protected health information available.
6. The Business Associate Agreements and Addendums are electronically on file in SLUGO under HIPAA. They are in a PDF format, thus cannot be changed in content. Only the parties to the agreement and the services being provided may be changed. These agreements can only be properly executed by the Purchasing Department. Two copies should be prepared in order to provide the vendor with an original.
7. Purchasing will maintain an original file of the Business Associate Agreement and or Addendum and will maintain an electronic database that will exhibit a current listing of those vendors, the services they are providing, and if they have, in fact, completed an agreement.
8. Only one Business Associate Agreement or Addendum is required by the University as long as the services to be performed remain constant. In the event that the vendor is providing more than one service, an additional agreement is required.
9. In the event that a vendor cannot meet a specific requirement of the Business Associate Agreement or Addendum, i.e., insurance, etc., an exception can be granted only by UNMC legal counsel. In these cases, Purchasing will be notified of such request for exception and will submit it for the legal exception.

For additional information, please contact the Compliance Officer or the Director, Business Services, or see UNMC Policy No. 8009, Contracts.

This page updated on Tuesday, December 19, 2006, by dkp.