TPM-08—HIPAA Business Associate Agreement

>Control Description

Organization Business Associate Agreements must contain provisions for the following: • permitted uses and disclosures of Protected Health Information (PHI) • PHI safeguards to prevent unauthorized use or disclosure • communications regarding the unauthorized use or disclosure of PHI • PHI availability • contract termination and disposition of PHI

Theme

Process

Type

Preventive

Policy/Standard

Vendor Information Security Policy

>Implementation Guidance

1. Ensure there is a documented business associate agreement which includes clauses but not limited to : • permitted uses and disclosures of Protected Health Information (PHI) • PHI safeguards to prevent unauthorized use or disclosure • communications regarding the unauthorized use or disclosure of PHI • PHI availability • contract termination and disposition of PHI 2. Ensure that a process is defined for all business associates to sign and acknowledge to this agreement

>Testing Procedure

1. Inspect Organization's Business Associate Agreements and validate that it includes the following: • permitted uses and disclosures of Protected Health Information (PHI) • PHI safeguards to prevent unauthorized use or disclosure • communications regarding the unauthorized use or disclosure of PHI • PHI availability • contract termination and disposition of PHI 2. For a sample business associate validate that they have signed the said agreement.