ATTACHMENT 1A - Business Associate Profile Application.pdf

<<Company Name, FY>>

Business Associate Application

IMPORTANT NOTE: UPON AWARD, THE PRIVACY OFFICER WILL INITIATE THE BAA PROCESS. THE PRIVACY OFFICER WILL ASK YOU TO COMPLETE THIS DOCUMENT AND THE BAA AS A PART OF THE BAA PROCESS.

THIS FORM ASKS QUESTIONS CONCERNING THE RELATIONSHIP BETWEEN YOUR COMPANY AND THE VETERANS HEALTH ADMINISTRATION (VHA) AND THE PRIVACY AND SECURITY OF VHA DATA REQUIRED BY YOUR COMPANY. WE REQUEST THAT THE APPROPRIATE COMPANY OFFICIALS WITH KNOWLEDGE OF PRIVACY AND SECURITY CONTROLS ASSIST WITH COMPLETING, SIGNING AND DATING THIS QUESTIONNAIRE.

Demographic Information

1. Company Name, Corporate Address & Website – Please include d/b/a information.

2. Addresses of Other/Alternate Office Locations where VHA Data is Maintained (other than telework locations).

3. Under the terms of your contract with VHA does your company act as a health care provider as defined by the HIPAA Regulations at 45 CFR §160.103? (NOTE: Health care provider means a provider of services (as defined in section 1861(u) of the Act, 42 U.S.C. 1395x(u)), a provider of medical or health services (as defined in section 1861(s) of the Act, 42 U.S.C. 1395x(s)), and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business. Healthcare providers include hospitals, clinics, doctors, psychologists, dentists, chiropractors, nursing homes, pharmacies, home health agencies, hospice program, home oxygen suppliers, dialysis centers, midwives, social work services and other providers of healthcare that transmit health information electronically.)

☐ Yes ☐ No

Company Name:

Corporate Address:

Company Website:

https://www.law.cornell.edu/cfr/text/45/160.103

4. Under the terms of your contract with VHA, do your employees act as members of the VHA workforce as defined by the HIPAA Regulations at 45 CFR §160.103? (NOTE: Workforce means employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity is under the direct control of such covered entity even when paid by the business associate. For example, the VA is able to directly fire the individual.)

5. Under the terms of your contract with the VHA, does your company’s function or services provided on behalf of the VHA meet the definition of treatment under the HIPAA Privacy Rule at 45 CFR § 164.501?

(NOTE: Treatment means the provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another. “Treatment includes provisioning, coordinating, managing of health care and other related services relative to a patient by a provider or on behalf of a provider or third party”.)

☐ Yes ☐ No

If you answered “Yes” to Question 3-5, please disregard the remaining questions, sign, and submit the form. If you answered “No” to Question 3, 4, or 5 continue to Question 6.

6. Check the appropriate positions assigned within your company:

☐ Privacy Officer ☐ Information Security Officer ☐ Compliance Officer ☐ Records Manager

7. Please provide contact information (name, email address, phone #) for your company official (Privacy

Officer, Information Security Officer, Compliance Officer, etc.) that VHA should contact regarding the Business Associate relationship.

Engagement with VHA

Protected Health Information (PHI) – PHI contains patient identif iers such as name, social security number and address or any other of the 18 data elements outlined in the HIPAA Privacy Rule.

Business Associate - A VHA Business Associate accesses, creates, receives, maintains, stores, or transmits Protected Health Information (PHI) to perform a function or activity on VHA’s behalf.

Privacy Officer:

Information Security Officer:

Compliance Officer:

Other:

Other:

https://www.law.cornell.edu/cfr/text/45/160.103 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=4f4ea50a0f95401268cc349b8bfcdacf&term_occur=999&term_src=Title:45:Chapter:A:Subchapter:C:Part:160:Subpart:A:160.103 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=118c2846b72bdf7c20f71ae0e1cc95ee&term_occur=999&term_src=Title:45:Chapter:A:Subchapter:C:Part:160:Subpart:A:160.103 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=118c2846b72bdf7c20f71ae0e1cc95ee&term_occur=999&term_src=Title:45:Chapter:A:Subchapter:C:Part:160:Subpart:A:160.103 https://www.law.cornell.edu/cfr/text/45/164.501 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=0bf30072cd447089063e3f884e42f705&term_occur=999&term_src=Title:45:Chapter:A:Subchapter:C:Part:164:Subpart:E:164.501 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=808782b490d63d2744ee5d9a1336d988&term_occur=999&term_src=Title:45:Chapter:A:Subchapter:C:Part:164:Subpart:E:164.501 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=0bf30072cd447089063e3f884e42f705&term_occur=999&term_src=Title:45:Chapter:A:Subchapter:C:Part:164:Subpart:E:164.501 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=808782b490d63d2744ee5d9a1336d988&term_occur=999&term_src=Title:45:Chapter:A:Subchapter:C:Part:164:Subpart:E:164.501 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=808782b490d63d2744ee5d9a1336d988&term_occur=999&term_src=Title:45:Chapter:A:Subchapter:C:Part:164:Subpart:E:164.501 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=0bf30072cd447089063e3f884e42f705&term_occur=999&term_src=Title:45:Chapter:A:Subchapter:C:Part:164:Subpart:E:164.501 https://www.law.cornell.edu/definitions/index.php?width=840&height=800&iframe=true&def_id=808782b490d63d2744ee5d9a1336d988&term_occur=999&term_src=Title:45:Chapter:A:Subchapter:C:Part:164:Subpart:E:164.501

8. Under the terms of your company’s contract with VHA, does your company use or disclose VHA’s PHI or does it access, store, create, receive, maintain, transmit or destroy VHA PHI?

If you answered “No” to Question 8, please disregard the remaining questions, sign and submit the form. If you answered “Yes” to Question 8, complete the following questions before submitting the form.

9. Please describe ALL the functions or services your company provides on VHA’s behalf. Please provide enough detail in your response so that the services your company provides are clearly enumerated.

10. Include the names of all VHA Program Offices, VA Medical Centers or VISNs that receive the services identif ied in Question 8 above. If your company provides services to all VAMCs/VISNs, please check the box for All VAMCs/VISNS.

VISNs:

VAMCs:

VHA Program Offices:

ALL VAMCs/VISNs: ☐

ACCESS TO VHA PHI/DATA:

11. How many employees have or will have access to VHA data overall?

Number of employees: ☐ 1-10 ☐ 11-25 ☐ 26-50 ☐ 51-100 ☐ Over 100 ☐ Over 500

12. Does your company access, create, receive, maintain, store, or transmit VHA PHI outside of a VHA facility? (Including PHI that has been disclosed to your company by VHA) ☐ Yes ☐ No (If you answered “No”, please skip to question 15.)

13. How many employees have access to VHA data outside a VHA facility?

Number of employees: ☐ 1-10 ☐ 11-25 ☐ 26-50 ☐ 51-100 ☐ Over 100 ☐ Over 500

14. What is the number of location(s) where employees access VHA data outside of a VHA facility?

(Including PHI that has been disclosed to your company by VHA)

Number of locations: ☐ 1 ☐ 2-5 ☐ Over 5 ☐ Over 10

14a List the location(s) where employees create, access, store or maintain VHA data outside of a VHA facility? Please provide Address, City, State, Zip Code, Country.

15. Do you have employees working remotely from home?

15a. Of your employees working remotely from home, how many will access VHA data from their home?

Number of employees: ☐ 1-10 ☐ 11-25 ☐ 26-50 ☐ 51-100 ☐ Over 100 ☐ Over 500

16. How will your employees access VHA PHI?

16a. Electronic Means of Access (Select all that apply):

☐ VPN ☐ CAG/Azure Virtual Desktop ☐ Interconnection ☐ Direct Access to VHA ☐

Other (please provide details)

16b. Hard copy means of accessing VHA PHI: (Select all that Apply)

☐ File ☐ Other Media (Films, Tissues, Photographs, Paper Documents) ☐ N/A

CREATION OF PHI/DATA:

17. Does your company create data for VHA or on VHA’s behalf?

☐ Yes ☐ No (If you answered “No”, please skip to question #17.)

17a. If your company creates data on VHA's behalf, is the data considered PHI or IIHI (Individually Identif iable Health Information)?

☐ Yes ☐ No ☐ N/A

17b. What PHI is created by your company for VHA on VHA's behalf? (Select all that Apply)

☐ Electronic ☐ Hardcopy (paper) ☐ N/A

TRANSMISSION OF PHI/DATA:

18. Does your company transmit PHI or data on VHA’s behalf?

☐ Yes ☐ No (If you answered “No”, please skip to question #21.)

18a. If yes, what type of PHI or data is transmitted? Please describe in space below:

18b. How does your company protect the PHI or data while it is being transmitted?

MAINTENANCE / STORAGE OF DATA:

19. Does your company maintain or store VHA data?

☐ Yes ☐ No (If you answered “No”, please skip to question #23.)

19a. What type of PHI or data does your company maintain or store on VHA’s behalf?

☐ Electronic ☐ Hardcopy (paper) ☐ Other ______________________

19b. If your company maintains or stores PHI/ePHI on VHA’s behalf, please describe where that information is maintained or stored (physical location, and local server, cloud server, file room, or other (provide details):

19c. If your company maintains/stores PHI/ePHI or data on VHA’s behalf, is it maintained separately from other data (not co-mingled with other data)?

19d. If VHA data/PHI/ePHI is maintained on a server, who maintains the data/server? ☐ N/A

Who maintains: ☐ Business Associate ☐ VHA/VA ☐ Sub-Contractor ☐ Other (please provide details below:

19e. If your company maintains or stores PHI/ePHI, please describe how that information is protected and safeguarded in accordance with the HIPAA Privacy and Security Rule in the space below.

DATA DESTRUCTION:

20. Does your company destroy VHA PHI/ePHI on VHA's behalf? (Including PHI that has been disclosed to your company by VHA)

☐ Yes ☐ No (If you answered “No”, please skip to question #27.)

☐ Return to VHA ☐ Retain for regulatory purposes ☐ Other

20a. If your company destroys PHI/ePHI or data on behalf of VA/VHA how is it destroyed?

☐ Shred ☐ Pulp ☐ Macerate ☐ Other If other, please describe method of destruction below:

20b. If your company destroys data on VHA’s behalf, does your company follow VHA’s records control schedule (RCS) for destruction of these records as outlined in RCS 10-1?

20c. If your company returns data to VHA, retains for regulatory purposes or if you responded “other”, please provide details in space below.

USE, DISCLOSURE, INCIDENTS, POLICIES, AND OTHER RELEVANT INFORMATION:

21. How many VHA records on individuals (PHI per individual) does your company create, access, receive, store, transmit, maintain, or destroy?

Number of Records: ☐ 0 ☐ 1-100 ☐ 100-1000 ☐ 1000-10,000 ☐ Over 10,000

22. Does your company use VHA PHI/ePHI for purposes other than those specified in your contract for which you are a Business Associate with VHA? (e.g., state reporting required of your company, litigation defense, etc.)

22a. If you answered yes, please list the purposes for which VHA data is being disclosed by your company outside the purposes under the BAA in the space below.

23. Does your company make disclosures of VHA PHI/ePHI to other individuals or entities in its provision of contracted services or activities to VHA, including disclosures to subcontractors for them to provide a portion of the service?

24. Does your company have direct contact with VHA patients?

25. Does your company receive requests from third parties for VHA data to be disclosed by you or created by you for purposes other than defined in the BAA?

26. Has your company ever been involved in an incident (as defined in the BAA) involving VHA PHI?

☐ Yes ☐ No (If answered “No”, skip to question #33.)

26a. How many data breaches or privacy incidents has your company had since completing the last application form?

Number of Breaches: ☐ None ☐ 1-5 ☐ 6-10 ☐ 11-20 ☐ Over 20 ☐ Over 50

26b. How many Veterans were affected?

Number of Veterans: ☐ Less than 500 ☐ Over 500

27. Has your company developed and documented policies and procedures that explain safeguards to protect PHI, and prevent use or disclosure of PHI not authorized by the BAA? (Specifically, policies related to Privacy, Security and Records Management)

Contracts with VA/VHA & Subcontractor Relationships

28. Please provide the contract numbers of your company’s current contracts with the VHA, MOU, or BPA against which VHA is purchasing items.

VAMCs:

VISNs:

VA/VHA Program Offices

29. Does your company have any contracts/underlying agreements with VHA, relating to this BAA, which will be expiring within the next year?

If you answered “Yes” to question 45, please identify the contract/underlying agreement and the date it expires: (If more than 2, use the additional space at bottom of form)

Agreement Title:

Expiration Date:

Agreement Title:

Expiration Date:

30. Has/have any of your company’s underlying contract(s)/agreement(s) with the VHA related to your BAA been modified in the last 2 years? If yes, please provide details in the space provided.

31. Has your company entered into other BAAs on a local/regional/VISN level with VHA? If yes, please provide details in the space below:

32. Does your company engage subcontractors in services provided to VHA under your BAA?

☐ Yes ☐ No (If you answered “No”, please skip to question #39.)

32a. Do you have HIPAA mandated subcontractor Business Associate Agreements with your subcontractors who provide a portion of your services to VHA?

NOTE: If your company doesn’t have appropriate subcontractor Business Associate Agreements in place, this requirement must be satisfied to adhere to HIPAA and VA requirements.

32b. Do you have a specific, documented chain-of-custody agreement that requires the subcontractor to meet the requirements set forth in your BAA with VHA?

32c. Do you have subcontractors who provide services to VHA that are outside of the jurisdiction of the laws of the United States?

33. Does your company have any other classification, other than Business Associate or health care provider, as defined under the HIPAA Privacy and Security Rules? (e.g., Covered Entity, Hybrid Entity, etc.)

33a. If yes, please provide the type of classification in the space below:

34. Please use this space for any additional information in response to the questions above:

Question #

Question #:

Etc.

Please obtain signatures for the appropriate company officials below:

Company Representative Date

Privacy/Compliance Officer Date

Information Security Officer Date

For questions concerning this questionnaire please contact the VHA BAA Issues mail group at vhabaaissues@va.gov.

mailto:vhabaaissues@va.gov