36C77620Q0042-010.pdf

STANDARD OPERATING PROCEDURE (SOP)

National and Local Business Associate Agreement Processing

I. PURPOSE: This Standard Operating Procedure (SOP) establishes the procedures for processing National Business Associate Agreements, Local Business Associate Agreements, National Business Associate Agreement Termination Letters and Monthly Reporting .

II. DEFINITIONs:

A. Business Associate - A Business Associate is an entity, including an individual (other than a member of VA’s workforce), company, organization or another covered entity, that performs or assists in the performance of a function or activity on behalf of VHA that involves the creating, receiving, maintaining or transmitting of PHI, or that provides to or for VHA certain services as specified in the Privacy Rule that involve the disclosure of PHI by VHA. The term “Business Associate” also includes a subcontractor of a Business Associate that creates, receives, maintains, or transmits protected health information on behalf of the Business Associate.

B. Local Business Associate Agreement - A local Business Associate Agreement (BAA) is negotiated and executed between a single VA medical facility and a single Business Associate. If the Business Associate provides services or activities meeting the Business Associate definition for two or more facilities, then a national BAA must be negotiated with that Business Associate.

C. National Business Associate Agreements - A National Business Associate Agreement (BAA) is negotiated and executed by the NDS/HIA Office and represents the agreements between two or more VA medical facilities (to include services contracted by a VISN, Regional or VHA Program Office contracting office) and a Business Associate. No other BAA may to be executed when a national BAA is in place without prior approval by the NDS/HIA Office.

III. RESPONSIBILITIES:

A. VHA Privacy Office.

The VHA Privacy Office provides guidance on VHA policies and procedures for complying with the HIPAA Privacy Rule and the HITECH Act regarding the Business Associate provisions.

B. NDS/HIA Office. The NDS/HIA Office is responsible for:

1. Managing and monitoring the BAA business processes for VHA;

2. Negotiating and signing national BAAs on behalf of VHA;

3. Providing support to field personnel regarding local BAAs;

4. Establishing guidance for all operational aspects of BAA management;

IV. PROCEDURES:

A. National Business Associate Agreement Pre-contact Phase

1. Evaluate contracted services to ensure BAA may be required

2. Check National Level and Local BAA website for existing BAA http://vaww.vhadataportal.med.va.gov/DataAccess/BusinessAssociateAgreements.aspx

3. Establish a Point of Contact (POC) with business associate

a. Ask referring entity for a POC

b. Access contractor’s website http://vaww.vhadataportal.med.va.gov/DataAccess/BusinessAssociateAgreements.aspx

c. Access eCMS http://vaww.aams.ecms.va.gov/aams_production/Desktop/DTMain.aspx

d. Access GSA site http://www.gsaelibrary.gsa.gov/ElibMain/home.do

e. Establish Microsoft Outlook Personal Folder for company

B. National Business Associate Profile Questionnaire Phase

1. Email Business Associate Profile Questionnaire to contractor

2. Text for email that will accompany the Business Associate Profile Questionnaire Mr. or Mrs. XXX, In our efforts to better understand the services provided by our business associates and quantify our business associate’s access to Protected Health Information, the Veterans Health Administration requests your cooperation in filling out the attached Business Associate Profile Questionnaire.

If you are not in a position to complete the questionnaire, please pass the document on to the appropriate company representative. We ask that the questionnaire be completed and returned as soon as possible. The questionnaire can be returned as a reply attachment to this email.

If you have any questions concerning the questionnaire, don’t hesitate to call me at the phone number below or by replying to this email.

Thank you for your cooperation in this matter.

3. Review returned Business Associate Profile Questionnaire for accuracy

4. Establish entry in VHA HIA BAA Reporting SharePoint site and set BAA Status as “Processing” https://vaww.vha.vaco.portal.va.gov/sites/HDI/HIA/Lists/BAA%20Reporting/BAA%20InProg.asp x

5. For new contractors, establish folder at Q:\10P2C\HIPAA\Business Associates Agreements

6. If Folder already exists, create subfolder titled 2015, 2016, etc.

7. Complete Business Associate Risk Analysis Worksheet

8. Forward completed Business Associate Risk Analysis Worksheet to Business Associate Program

Manager for review and approval

9. Annotate date Business Associate Profile Questionnaire received and Risk Analysis score at VHA

HIA BAA Reporting SharePoint site C. National Business Associate Agreement Phase

1. Customize standard VHA National BAA template Word document with business associate’s legal name, services provided as highlighted in preamble and VHA signature authority signature block

2. Save draft template file to Q:drive as xxxbaa_2015.doc (where xxx is a good representation of the company name, can use previous file name and add new date)

3. Email POC and attach template and include the following statement in the body of the email:

http://vaww.aams.ecms.va.gov/aams_production/Desktop/DTMain.aspx http://www.gsaelibrary.gsa.gov/ElibMain/home.do https://vaww.vha.vaco.portal.va.gov/sites/HDI/HIA/Lists/BAA%20Reporting/BAA%20InProg.aspx https://vaww.vha.vaco.portal.va.gov/sites/HDI/HIA/Lists/BAA%20Reporting/BAA%20InProg.aspx

Dear Mr. or Ms. XXX, Attached, please find a customized Veterans Health Administration (VHA) National Business Associate Agreement (BAA) for the relationship between (Company Name) and VHA.

This agreement reflects requirements contained in the Health Insurance Portability & Accountability Act (HIPAA), the Health Information Technology for Economic & Clinical Health (HITECH) Act and mandates enacted by the Department of Veterans Affairs (VA) and VHA.

This document has been vetted through the VA Office of General Counsel and other VA offices and as such, there will be minimal opportunities to amend the agreement. This agreement will replace any previous agreements executed for the same services indicated in the preamble of the agreement and cover these services at any VHA facility. You will not need to sign any additional BAAs for the same services.

Please review the agreement and provide any questions to my attention by replying to this email or at the phone number below.

Thank you for your assistance in this matter.

4. Annotate date Business Associate Agreement sent at VHA HIA BAA Reporting SharePoint site

5. Send follow up email to business associate if no reply received in two weeks. Use the following statement:

Mr. or Ms. Xxxx, Please provide an update on your review of the National Business Associate Agreement between (Company Name) and the Veterans Health Administration.

If you have any questions concerning this agreement, please provide those to my attention.

Thank you for your assistance in this matter.

6. Make follow up calls/emails if review by business associate slows or you receive no feedback

7. Discuss any questions or comments business associate may have concerning language or intent

8. Refer any previously unapproved edits to agreement language to the VA Office of General

Counsel

9. Receive partially executed BAA from contractor

10. Annotate date Business Associate Agreement received from vendor at the VHA HIA BAA

Reporting SharePoint site

11. Convert partially executed BAA to Adobe .pdf document and add signature authority’s electronic signature stamp

12. Save document to Q:drive with the (-o) extension after the file name date (xxxbaa_2015-o)

13. Forward partially executed BAA to signature authority

14. Receive fully executed BAA from signature authority

15. Save fully executed document to Q:drive

16. Forward fully executed agreement with the following statement to business associate POC and anyone else included on previous emails

Mr. or Ms. XXX

Thank you for your assistance in executing the National Business Associate Agreement between (Company Name) and the Veterans Health Administration.

I have attached a scanned copy of the fully executed agreement. There may be other requirements, in addition to the BAA, necessary before VHA can disclose Protected Health Information (PHI), please check with the appropriate Contracting Officer, Contracting Officer’s Representative or VA Information Security Officer for any additional guidance.

If you have any questions concerning this arrangement or VHA business associate practices, please don’t hesitate to contact us.

Regards

17. Update VHA HIA BAA Reporting Sharepoint site with date BAA was executed

18. Change BAA Status to either BAA Executed (New) for a new company or BAA Executed

(Renewal) for a renewal of an old BAA

D. BAA Termination Letter Procedures. This process is initiated once it has been determined that a contractor’s role as a business associate has been terminated.

1. Determine the reason for termination (acquisition, treatment, no access to PHI)

2. Request name, title, and address for signature authority for contractor

3. Update BAA Termination Access database with appropriate information

a. Q:\10P2C\HIPAA\BAA Update – 2010\Terminated BAAs for no access to PHI terminations

b. Q:\10P2C\HIPAA\BAA Update – 2010\Terminated BAA2 for all other reasons

4. Draft standard BAA Termination Letter based on reason for termination

a. Q:\10P2C\HIPAA\BAA Update – 2010\BAA Termination Letter for no access to PHI terminations

b. Q:\10P2C\HIPAA\BAA Update – 2010\BAA Termination Letter2 for all other reasons

5. Save mail merged Word Termination Letter as an Adobe .pdf document

6. Insert signature authority’s electronic name stamp

7. Re-save document as an Adobe .pdf and send to signature authority

8. Email partially executed Termination Letter to contractor with the following email message:

Mr. or Ms. XXXX, Attached, please find a VHA National Business Associate Agreement Termination Letter for counter-signature.

Please sign, scan and return to me via email.

Thank you for your assistance.

9. Place fully executed Termination Letter in appropriate Q:\10P2C\HIPAA\Business Associates Agreements folder E. Local BAA Management. This process is utilized when a Local BAA is received for upload to the Local

BAA SharePoint site.

1. Receive Local BAA from VHA Privacy Officer or other source

2. Access Local BAA Tracker:

https://vaww.vha.vaco.portal.va.gov/sites/HDI/HIA/Lists/LocalBAATracker/AllItems.aspx

3. Click “Items” in the upper left tabs, click “New Items”

4. Annotate appropriate information for the Local BAA

5. Click “Save” to save the entry

F. Monthly Reporting

1. VHA HIA BAA Portal Page Updates

a. Create an email for the VHA HIA BAA Portal Page website manager

b. Update and insert the Status of National Office Level Business Associate Agreements report into the email: Q:\10P2C\HIPAA\Business Associates Agreements\Status Reports\Website Status Reports

c. Insert any new, renewed or terminated BAAs

d. Annotate if any new Local BAAs were added during the month

e. Email report to VHA HIA BAA Portal Page website manager

2. HIA NDS Reporting Dashboard

a. NDS/HIA Reports Manager autopopulates BAA data from VHA HIA BAA Reporting SharePoint site

b. Collect data from contracted services provider https://vaww.vha.vaco.portal.va.gov/sites/HDI/HIA/Lists/LocalBAATracker/AllItems.aspx file://vacohsm01.dva.va.gov/VACO_Workgroups/VHA/10p2/10P2C/HIPAA/Business%20Associates%20Agreements/Status%20Reports/Website%20Status%20Reports file://vacohsm01.dva.va.gov/VACO_Workgroups/VHA/10p2/10P2C/HIPAA/Business%20Associates%20Agreements/Status%20Reports/Website%20Status%20Reports

Hello Xxxxxx, Thank you for your assistance in executing the current National Business Associate Agreement (BAA) between Xxxxxxx Xxxxxx and the Veterans Health Administration (VHA) (attached). In accordance with Section 9 of the agreement, VHA is conducting the two year review of the BAA.

Please review the Scope of the attached agreement and ensure that the bolded services identified are still applicable. A new BAA doesn’t have to be executed if new contracts or other agreements have been established for the identified services. In addition, please provide us with any information that may have impacted the legal standing of your company, to include any name change, acquisition, contract termination, etc.

We have also attached the current Business Associate Profile Questionnaire, we ask that you review the questionnaire, if there are any changes, please complete the attached blank questionnaire. If there are no changes to the questionnaire, please indicate such in a return email.

If there are no changes with the Business Associate Agreement, we will annotate the two year review at the VA Intranet BAA portal page. If we need to update the agreement, we will start the process after receiving your feedback.

If you have any questions concerning this review or VHA business associate practices, please don’t hesitate to contact me

Regards

c. Update BAA data for HIA NDS Reporting Dashboard:

https://vaww.vha.vaco.portal.va.gov/sites/HDI/HIA/WebPart%20Pages/NDS%20HIA%20Repor ting.aspx

G. Two-Year Review Process. This process is to invoke the Review Date section of the National Business Associate Agreement.

1. Access Active National Business Associate Agreement database https://vaww.vha.vaco.portal.va.gov/sites/HDI/HIA/Lists/BAA%20Reporting/BAAActive.aspx by BAA Executed date

2. Extract business associates whose agreements are due for review during the current month

3. Send email announcing Two-Year Review

4. Attach current BAA, latest Business Associate Profile Questionnaire and blank Business Associate Profile Questionnaire

5. Follow up as necessary

6. If client determines that there are no changes in the Questionnaire or BAA, annotate the Two- Year Review on the signature page of the current agreement https://vaww.vha.vaco.portal.va.gov/sites/HDI/HIA/WebPart%20Pages/NDS%20HIA%20Reporting.aspx https://vaww.vha.vaco.portal.va.gov/sites/HDI/HIA/WebPart%20Pages/NDS%20HIA%20Reporting.aspx https://vaww.vha.vaco.portal.va.gov/sites/HDI/HIA/Lists/BAA%20Reporting/BAAActive.aspx https://vaww.vha.vaco.portal.va.gov/sites/HDI/HIA/Lists/BAA%20Reporting/BAAActive.aspx

This VHA National Business Associate Agreement has been reviewed by both parties in accordance with Section 9 of the agreement and the agreement has been determined to be applicable and accurate based on the circumstances that existed as of the date indicated in the signature below.

8/13/20xx James R. “Mickey” Gwyn Business Associate Program Manager

7. If the Questionnaire needs to be updated, but not the BAA, follow instructions at Section IV.B. 3-9 above

8. Annotate the current BAA as in Step 6 above

9. If both Qustionnaire and BAA needs to be updated:

a. Follow instructions at Section IV.B. 3-9 above to update Questionnaire

b. Follow appropriate procedures at Section IV.C. above

10. If BAA needs to be terminated, follow procedures at Section IV.D. above

11. Update Status of National Office Level Business Associate Agreements

12. Email text for monthly report should be:

Business Associate Name (Reviewed MM/YYY – Cancelled)