By Doris Dike, Attorney

A business associate agreement is the HIPAA contract a practice must sign before a vendor can create, receive, keep or send patient information on its behalf. It limits how the vendor may use that information, requires safeguards and breach reporting, and binds the vendor’s subcontractors. Without one, the practice is out of compliance.

Who Counts as a Business Associate?

If you are asking what is a business associate agreement for, start with who needs one. Under HIPAA, a business associate is any person or company outside your workforce that handles protected health information to perform a service for your practice. Common examples in Texas practices include:

• Billing and coding companies
• EHR, practice management and patient portal vendors
• Cloud storage, email, IT support and cybersecurity firms
• Answering services, scheduling platforms and AI scribe tools
• Marketing agencies that work with patient lists or reviews
• Consultants, accountants and attorneys who see patient records
• Management services organizations that run the business side of a practice

The last one surprises many owners. In a Texas MSO structure, the management company almost always handles patient information, so the practice and the MSO need a HIPAA business associate agreement alongside the management services agreement. Our guide to the friendly-PC and MSO model explains how the two entities fit together.

Who Does Not Need a BAA

Not every outside party is a business associate. A BAA is generally not needed for:

• Other providers receiving information for treatment, such as a referral to a specialist
• Your own employees and other workforce members, who are covered by your policies and training instead
• Pure conduits that only transmit data and do not store it, such as the postal service
• Payers receiving claims for payment

The test is the service, not the label. A cleaning company that might glimpse a chart does not need one; a shredding company that handles boxes of records does.

What a BAA Contract Must Include

HIPAA sets the minimum terms of every BAA contract. The agreement must:

1. Describe the permitted uses and disclosures of protected health information
2. Prohibit any other use or disclosure, except as required by law
3. Require reasonable safeguards, including Security Rule safeguards for electronic information
4. Require the vendor to report breaches, security incidents and improper disclosures to the practice
5. Require the same restrictions to flow down to any subcontractors
6. Support patients’ rights to access, amend and get an accounting of their information
7. Make the vendor’s books and records available to HHS when asked
8. Require return or destruction of the information when the relationship ends
9. Allow the practice to terminate the contract if the vendor materially breaches it

HHS publishes sample BAA provisions, and many practices start from a business associate agreement template. A template covers the federal minimum, but it rarely addresses Texas law, breach timing, cyber insurance or who pays for a breach response.

Terms Worth Negotiating Beyond the Minimum

• Breach reporting deadline: shorter than the federal outer limit, so you can meet your own notice duties
• Cost allocation: who pays for notices, credit monitoring and forensic work if the vendor caused the breach
• Indemnification and insurance: whether the vendor carries cyber coverage and names the practice
• Offshore access: whether information can be stored or viewed outside the United States
• AI and de-identified data: whether the vendor may use your data to train tools or build products
• Audit rights: whether you can confirm the vendor’s safeguards

Texas Rules That Sit on Top of HIPAA

Texas has its own medical privacy law, the Texas Medical Records Privacy Act, expanded by House Bill 300. It defines covered entities more broadly than HIPAA, reaching many businesses that assemble, store or use health information, and it requires staff training on state privacy rules. Texas also has its own breach notice law, which can require notice to the Texas Attorney General.

So a vendor that is not a HIPAA business associate may still have duties under Texas law, and your BAA should require the vendor to follow both. Our HIPAA compliance checklist for Texas practices covers the wider program.

What Happens If You Do Not Have a BAA

Missing BAAs are one of the most common findings in HHS Office for Civil Rights investigations. If a vendor without a BAA suffers a breach, the practice faces questions about why patient data was shared at all, and both the practice and the vendor can face penalties. Since the 2013 HIPAA changes, business associates are directly liable for their own compliance, but that does not take the obligation off the practice.

The fix is simple: list every vendor that touches patient data, confirm a signed BAA exists for each, and calendar renewals. Our article on common HIPAA violations shows where else practices slip.

Quick Reference

1. Does the vendor handle patient information for you? It needs a BAA.
2. Is it another provider treating the patient? No BAA needed.
3. Is your MSO handling patient data? Sign a BAA with it.
4. Does the template cover Texas law and breach costs? Usually not.
5. Do subcontractors sign too? Yes, the terms must flow down.

Frequently Asked Questions

What is a BAA in healthcare?

A BAA, or business associate agreement, is the contract HIPAA requires between a healthcare provider and a vendor that handles patient information on its behalf. It sets the rules for using, protecting and reporting problems with that information.

Does my billing company need to sign a BAA?

Yes. A billing company handles protected health information to perform a service for your practice, so it is a business associate and needs a signed BAA before it receives any patient data.

Is a business associate agreement template enough?

A template covers HIPAA’s minimum terms, but it often misses Texas privacy law, breach cost allocation, insurance and AI data use. Have the template reviewed for your vendors before relying on it.

Who is responsible if my vendor has a breach?

Both of you can be. The vendor is directly liable for its own HIPAA failures, and the practice must still give required notices to patients and regulators. A well-drafted BAA decides who pays for the response.

How often should BAAs be reviewed?

Review them when you add or change vendors, when the vendor’s services change, and at least once a year as part of your HIPAA risk assessment.

This article is general information about Texas healthcare law and is not legal advice. Reading it does not create an attorney-client relationship with Dike Law Group PLLC.

The post What Is a Business Associate Agreement? HIPAA BAA Rules for Texas Practices first appeared on Dike Law Group.

Employees Looking at Private Records

The HIPAA Privacy Rule says people can only look at patient health files for very specific reasons. These include giving treatment, getting paid, or running the medical office. Any other reason for a worker to open a file is wrong and breaks patient privacy. This habit of “snooping” is a top reason for legal trouble today. It happens when workers look at the files of people they know, like friends or famous people. If a business finds out this is happening, the worker usually loses their job right away and could even face criminal charges.

Organizations also pay large fines when this happens. For example, one health system had to pay $865,000 because they did not stop a doctor from looking at celebrity files. To stop this in your Dallas office, you must put in security tools that block general access. You could use better passwords for digital health info or keep a log that shows every time someone opens a file.

Not Checking for Security Risks

Many businesses do not do a full check of their entire company to find security holes. This means they cannot see where their system is weak. Other doctors might do the check but then fail to fix the problems they found. They might wait too long to act, and by then, the damage is already done. A full check can show many flaws, like weak passwords or a lack of good training for the team. In fact, many medical workers do not fully understand how these laws work.

The government can give out big fines if you do not do these checks. To stay safe and keep your good name, you should start a risk check now or hire someone else to do it for you. Once you have the results, fix the biggest problems first. Spending the time and money now helps you avoid much bigger headaches later.

Problems with Business Partner Contracts

Healthcare providers usually work with outside vendors who see patient data. If the paperwork with these partners does not use the right legal language, your business might be at risk for fines. It is also worth noting that an old contract might have been fine years ago but is not okay now. This is true for any agreement signed before the 2013 law changes. Some of the payments for these mistakes have reached over one million dollars.

To keep away from these fines, you should look at any contract you signed before 2013. For new deals, make sure you use the language required by federal guidelines. Doris Dike can help you review these agreements to ensure they meet current standards.

Weak Controls for Digital Health Info

Years ago, most health info was on paper, which was harder to get to but sometimes safer than digital files. Today, it is almost impossible for a Dallas medical office to work without using computers to see patient data. Even so, the law says you must have controls in place so only the right people can get in. Failing to set up these controls is a common reason why state lawyers or federal offices step in.

If you want to avoid fines, make sure your office has a system that watches who is logging in. You can look into things like two-step logins to keep things safe without making it too hard for your staff to do their jobs.

Forgetting to Use Data Coding

Coding data, or encryption, is one of the best ways to stop a major data leak. It is so helpful that if coded info is stolen, you usually do not even have to report it as a breach unless the thief also got the digital key. While the law does not strictly force you to use coding, you must use something just as strong if you choose not to.

Not using these tools can lead to massive penalties. A center in Dallas once paid $3.2 million because they did not fix known risks, like having no coding on mobile devices. To stay safe, make sure you use these tech tools on all your portable gear.

Sharing Health Info When You Should Not

Sharing info the wrong way covers a lot of ground. It means any time health data goes out in a way the law does not allow. This could be telling a patient’s boss something private or losing a laptop that has files on it. It also happens if a worker is careless or sends info after a patient said they no longer want it shared.

These mistakes can cost millions in civil fines. To lower this risk, train your team on how to handle devices. Tell them not to leave laptops in public or leave their screens open. It also helps to use a checklist to make sure it is okay to share info before anyone sends it out.

Blocking a Patient from Their Own Files

Patients have a legal right to see their medical records and get copies quickly. If a company tells them no, charges too much for copies, or takes longer than 30 days, they are breaking the rules. One health group was fined over $4 million for not letting patients see their files. The government is now looking much more closely at these types of complaints.

To avoid this, you need a clear plan for answering patient requests within the 30-day window.

Waiting Too Long to Report a Breach

If a data leak affects more than 500 people, you have to report it without waiting too long. The limit is 60 days after you find out about it. Missing this deadline is a very common mistake and leads to heavy fines. To prevent this, make sure the right offices are told and that you put a notice on your website or tell the local news if needed.

Throwing Away Records the Wrong Way

The law says you must get rid of paper and digital files properly once you no longer need to keep them. For paper, this means shredding it so it cannot be read. For digital files, you might need to wipe the drive or destroy the device entirely. If you just throw these things in the trash, someone could find them, leading to a privacy breach and big fines. You can stay safe by using a professional service to destroy old records and devices.

These nine issues are just a few ways things can go wrong. If you are going through a growth phase or experiencing changes in your practice, having a healthcare attorney can help you stay on the right path. Reach out to Doris Dike at Dike Law Group in Dallas at (972) 290-1031 to talk about your business operations.

The post Most Common HIPAA Violations and How to Avoid Them first appeared on Dike Law Group.

The U.S. Department of Health and Human Services (HHS) has updated the Privacy Rule of the Health Insurance Portability and Accountability Act (HIPAA) of 1996. This change, driven by the Biden-Harris administration through the Office for Civil Rights (OCR), follows the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization. As a result, 21 states have enacted abortion bans and reproductive rights restrictions. Consequently, the administration has moved to enhance protections for reproductive health care privacy.

Key Changes to HIPAA’s Privacy Rule

The new rule introduces vital safeguards against the misuse of Protected Health Information (PHI) related to reproductive health care. Specifically, healthcare providers, health plans, clearinghouses, and business associates must now:

• Avoid using or disclosing PHI for criminal, civil, or administrative investigations into lawful reproductive health care.
• Refrain from identifying individuals for such investigations or imposing liability.

Presumption of Lawfulness and Attestation Requirement

The Final Rule presumes that reproductive health care provided by a third party is lawful, unless the covered entity has actual knowledge or receives substantial evidence to the contrary. Additionally, when faced with PHI requests, covered entities must now:

• Obtain a signed attestation to confirm that the disclosure or use is not for prohibited purposes.
• This requirement applies to requests involving:
  • Health oversight activities.
  • Judicial and administrative proceedings.
  • Law enforcement purposes.
  • Disclosures to coroners and medical examiners.

These attestations are crucial. They protect your entity and discourage misuse of the disclosure process.

Compliance and Legal Guidance

Implementing these new HIPAA regulations can be challenging. Therefore, healthcare providers, health plans, and business associates must update their privacy practices accordingly.

If you’re in need of help, guidance or have questions concerning healthcare business legal matters or trademarks, we invite you to explore our website at Dike Law Group. To initiate a free intake discussion, please go to http://www.dorismeet.com/, where you can schedule a meeting with the attorney. Our services assist healthcare professionals in Texas and throughout the country.

The post New HIPAA Rule on Reproductive Health Care Disclosure first appeared on Dike Law Group.