Business Associate Agreements (BAA)

The Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act include specific requirements for language that needs to be included in contracts with vendors and agencies (i.e., Business Associates) that perform work involving the use and/or disclosure of protected health information (PHI). A Business Associate Agreement (BAA) is required for contracts between LLUH and a person or entity (i.e., business associate) which performs functions or activities on behalf of, or provides services to LLUH, where the Business Associate creates, receives, maintains, or transmits LLUH’s PHI.

Before entering into a contractual agreement with any person or entity, a determination needs to be made about whether a BAA is required. In order to assist with this, the Office of Corporate Compliance has developed a Business Associate Decision Matrix that should be used to assist in making this determination.

Once a determination is made that a BAA is required, the person or entity who is seeking to establish a business relationship with LLUH shall be provided with a copy of the LLUH template BAA for their signature.

Please be aware that the language contained in the LLUH template BAA has already been approved by the Office of General Counsel and modifications to the BAA terms must not be made without further approval from the Office of General Counsel.

Business Associate Agreement templates

To obtain a copy of LLUH template BAA document to provide to the vendor, please submit an online request to the Office of Corporate Compliance at https://lomalindahealth.cqs.symplr.com/Portal/CreateForm/450004. If prompted to enter a User Name and Password, select “Continue without Login”.

Business Associate Agreement Tools & Reports

• Business Associates (BA) and Business Associate Agreements (BAA) Status Report
• (Database report with current status on signature/execution of the new BAA)
• Contract/Business-Associate-Agreement (BAA) Decision Matrix
  (Tool to help determine if a vendor or contractor is considered a "Business Associate"  under the Privacy Rule, thus requiring a signed BAA)
• Business Associate Decision Chart
• BAA Execution Process- Flowchart