The regulations do not contain a specific contractual language that must be included in an agreement, although they include certain points that should be addressed, such as .B obligation for the third party to take protective measures to prevent unauthorized use and advertising. Existing BAAs should already look at what is required in Part 2; That is why we do not believe that it is necessary to amend the BAA to contain these specific provisions. Instead, BAAs should be updated to include a language that directly indicates compliance with Part 2 requirements. This can be as simple as adding a sentence to the part of the BAA that discusses compliance with existing laws and regulations, which expressly provides that the counterparty is required to comply with Part 2. If you work for a covered facility, which is supported in one way or another at the federal level and provides substance abuse services that meet the criteria of a program under drug law and alcohol secrecy – in other words, the covered company “maintains itself as a provider of alcohol or drug abuse diagnoses, treatment or remittances for treatment (42 CFR, Part 2, 2.11)”1 – then you must take this federal law into account when writing your associate contracts. This can be done by inserting the agreement on qualified service organisations into the matching agreement and ensuring that aspects of the counterparty agreement are not contrary to the terms of the qualified service organisation agreement. This agreement is very short, but complete and reads: As soon as you are certain that a matching agreement is appropriate, it may be useful to start with an example of a partnership contract that generally meets your requirements, for example. B that www.hhs.gov/ocr/hipaa on the Office for Civil Rights (OCR) website. If you do not have patients protected by other federal or national laws, stricter in protecting their data protection rights, you can follow the OCR agreement and fill in the gaps.

Can this person or any other organization give you satisfactory assurances that they will adequately protect your company`s protected health information? If this is not the case, you cannot enter into an associate agreement with that person or any other entity.