36C77620Q0042-011.pdf

BUSINESS ASSOCIATE AGREEMENT (BAA) CHECKLIST

This checklist is utilized after a referral of a possible business associate by a VHA Privacy Officer, VA Contracting Officer or other source.

� Evaluate contracted services to ensure BAA may be required

� Check National Level and Local BAA website for existing BAA http://vaww.vhadataportal.med.va.gov/DataAccess/BusinessAssociateAgreements.aspx

� Establish a Point of Contact (POC) with business associate o Ask referring entity for a POC o Access contractor’s website o Access eCMS http://vaww.aams.ecms.va.gov/aams_production/Desktop/DTMain.aspx o Access GSA site http://www.gsaelibrary.gsa.gov/ElibMain/home.do

� Email Business Associate Profile Questionnaire to contractor

� Text for email that will accompany the Business Associate Profile Questionnaire

Mr. or Mrs. XXX, In our efforts to better understand the services provided by our business associates and quantify our business associate’s access to Protected Health Information, the Veterans Health Administration requests your cooperation in filling out the attached Business Associate Profile Questionnaire.

If you are not in a position to complete the questionnaire, please pass the document on to the appropriate company representative. We ask that the questionnaire be completed and returned as soon as possible.

The questionnaire can be returned as a reply attachment to this email.

If you have any questions concerning the questionnaire, don’t hesitate to call me at the phone number below or by replying to this email.

Thank you for your cooperation in this matter.

� Annotate SharePoint site with updates all along this process https://vaww.vha.vaco.portal.va.gov/sites/HDI/HIA/Lists/BAA%20Reporting/BAA%20InProg.aspx

� For new contractors, establish folder at Q:\10P2C\HIPAA\Business Associates Agreements

� If Folder already exists, create subfolder titled 2015, 2016, etc.

� Review returned Business Associate Profile Questionnaire for accuracy

� Complete Business Associate Risk Analysis Worksheet

� Forward completed Business Associate Risk Analysis Worksheet to Business Associate Program Manager for review and approval http://vaww.vhadataportal.med.va.gov/DataAccess/BusinessAssociateAgreements.aspx http://vaww.aams.ecms.va.gov/aams_production/Desktop/DTMain.aspx http://www.gsaelibrary.gsa.gov/ElibMain/home.do https://vaww.vha.vaco.portal.va.gov/sites/HDI/HIA/Lists/BAA%20Reporting/BAA%20InProg.aspx

� Customize standard VHA BAA template Word document with business associate’s legal name, services provided as highlighted in preamble and VHA signature authority signature block

� Save draft template file to Q:drive as xxxbaa_2015.doc (where xxx is a good representation of the company name, can use previous file name and add new date)

� Contact business associate POC via email, attach template and include this statement in the body of the email:

Dear Mr. or Ms. XXX, Attached, please find a customized Veterans Health Administration (VHA) Business Associate Agreement (BAA) for the relationship between (Company Name) and VHA.

This agreement reflects requirements contained in the Health Insurance Portability & Accountability Act (HIPAA), the Health Information Technology for Economic & Clinical Health (HITECH) Act and mandates enacted by the Department of Veterans Affairs (VA) and

VHA.

This document has been vetted through the VA Office of General Council and other VA offices and as such, there will be minimal opportunities to amend the agreement. This agreement will replace any previous agreements signed for the same services indicated in the preamble of the agreement and cover these services at any VHA facility. You will not need to sign any additional BAAs for the same services.

Please review the agreement and provide any questions to my attention by replying to this email or at the phone number below.

Thank you for your assistance in this matter.

� Send follow up email to business associate if no reply received in two weeks. Use the following statement:

Mr. or Ms. Xxxx, Please provide an update on your review of the Business Associate Agreement between (Company Name) and the Veterans Health Administration.

If you have any questions concerning this agreement, please provide those to my attention.

Thank you for your assistance in this matter.

� Make follow up calls/emails if review by business associate slows or you receive no feedback

� Discuss any questions or comments business associate may have

� Discuss extensive changes to VHA BAA template with VA OGC

� Receive partially executed BAA from contractor

� Convert partially executed BAA to Adobe .pdf document and add signature authority’s electronic signature stamp

� Save document to Q:drive

� Forward partially executed BAA to signature authority

� Receive fully executed BAA from signature authority

� Save fully executed document to Q:drive

� Forward fully executed agreement with the following statement to business associate POC and anyone else included on previous emails

Mr. or Ms. XXX

Thank you for your assistance in executing the National Business Associate Agreement between (Company Name) and the Veterans Health Administration.

I have attached a scanned copy of the fully executed agreement. There may be other requirements, in addition to the BAA, necessary before VHA can disclose Protected Health Information (PHI), please check with the appropriate Contracting Officer, Contracting Officer’s Representative or VA Information Security Officer for any additional guidance.

If you have any questions concerning this arrangement or VHA business associate practices, please don’t hesitate to contact us.

Regards

BAA TERMINATION LETTER PROCEDURES

This process is initiated once it has been determined that a contractor’s role as a business associate has been terminated.

� Determine the reason for termination (acquisition, treatment, no access to PHI)

� Request name, title, and address for signature authority for contractor

� Update BAA Termination Access database with appropriate information o Q:\10P2C\HIPAA\BAA Update – 2010\Terminated BAAs for no access to PHI terminations o Q:\10P2C\HIPAA\BAA Update – 2010\Terminated BAA2 for all other reasons

� Draft standard BAA Termination Letter based on reason for termination o Q:\10P2C\HIPAA\BAA Update – 2010\BAA Termination Letter for no access to PHI terminations o Q:\10P2C\HIPAA\BAA Update – 2010\BAA Termination Letter2 for all other reasons

� Save mail merged Word Termination Letter as an Adobe .pdf document

� Insert signature authority’s electronic name stamp

� Re-save document and send to signature authority

� Email partially executed Termination Letter to contractor with the following email message:

Mr. or Ms. XXXX, Attached, please find a VHA Business Associate Agreement Termination Letter for counter-signature.

Please sign, scan and return to me via email.

Thank you for your assistance.

Regards, � Follow up as needed

� File fully executed Termination Letter in the appropriate folder of the Q:drive