D.1a - Business Associate Questionnaire.docx

Business Associate Questionnaire

DISCLAIMER: DO NOT INCLUDE ANY VETERAN/PATIENT INDIVIDUALLY IDENTIFIABLE INFORMATION IN THIS FORM. THIS QUESTIONNAIRE ASKS QUESTIONS CONCERNING THE PRIVACY AND SECURITY OF VETERANS HEALTH ADMINISTRATION DATA, WE REQUEST THAT THE APPROPRIATE COMPANY OFFICIALS WITH KNOWLEDGE OF PRIVACY AND SECURITY CONTROLS ASSIST WITH COMPLETING, SIGNING AND DATING THIS QUESTIONNAIRE.

1. Company Name & Address:

2. A VHA Business Associate creates, receives, maintains, or transmits Protected Health Information (PHI) (patient identifiers such as name, social security number and address or any other of the 18 data elements outlined in the HIPAA Privacy Rule) to perform a function or activity on VHA’s behalf. Define in your own words, the function or activity your company provides on VHA’s behalf. (Include all services currently being provided regardless of whether they are covered under the National Business Associate Agreement (BAA) with VHA)

3. Does your company’s function or activity involve the use or disclosure of VHA’s PHI or do you access, create, receive, maintain or transmit VHA PHI?

☐ Yes ☐ No If you answered “No” to question 3, please disregard the remaining questions and submit form. If you answered “yes” to question 3, complete the following questions before submitting the form.

4. Please provide contact information for your company official (Privacy Officer, Information Security Officer, Compliance Officer, etc.) that VHA should contact regarding the BAA relationship.

5. Include the names of all of the VA Medical Centers, Program Offices or VISNs that receive the services identified above. (If more than 10, insert the number)

6. Does your company have any contracts/underlying agreements with VHA, relating to this BAA, which will be expiring within the next year?

☐ Yes ☐ No

If you answered “Yes” to question 6, please identify the contract/underlying agreement and the date it expires: (If more than 2, use the additional space at bottom of form)

Agreement Title:

Expiration Date:

Agreement Title:

Expiration Date:

7. Does your company access, create, receive, maintain or transmit VHA PHI? (Select all that apply) ☐ Access ☐ Create ☐ Receive ☐ Maintain ☐ Transmit

7a. What is the number of your employees with access to VHA data?

Number of employees: ☐ 1-25 ☐ 26-100 ☐ Over 100

8. Does your company access, create, receive, maintain, or transmit VHA PHI outside of a VHA facility? (Including PHI that has been disclosed to your company by VHA) ☐ Yes ☐ No If you answered “No” to question 8, please skip to question 9.

8a. What is the number of employees with access to VHA data outside a VA facility?

Number of employees: ☐ 1-25 ☐ 26-100 ☐ Over 100

8b. What is the number of location(s) where employees access VHA data outside of a VHA facility? (Including PHI that has been disclosed to your company by VHA) Number of locations: ☐ 1 ☐ 2-5 ☐ Over 5

8c. What are the location(s) where employees create, access, store or maintain VHA data outside of a VHA facility?

Location (Address, City, State, Zip Code)

9. How is VHA PHI accessed? (Select all that Apply) 9a. Electronic Means of Access:

☐ VPN ☐ CAG ☐ Interconnection ☐ Direct Access to VHA ☐ Other

9b. What are your hard copy means of accessing VHA PHI? (Select all that Apply) ☐ File ☐ Other Media (Films, Tissues, Photographs, Paper Documents) ☐ NA

9c. What PHI is created by your company for VHA on VHA's behalf? (Select all that Apply) ☐ Electronic ☐ Hardcopy ☐ NA

10. How many VHA records does your company create, access, store or maintain?

Number of Records: ☐ 0 ☐ 1-25 ☐ 26-1000 ☐ Over 1000

11. Does your company use VHA PHI for purposes other than those specific to the functions or activities for which you are a Business Associate with VHA? (e.g., state reporting required of your company)

If you answered yes, please list the purposes for which VHA data is being disclosed by your company outside the purposes under the BAA.

12. Does your company make disclosures of VHA PHI to other individuals or entities in its provision of specific services or activities to VHA, including disclosures to subcontractors in order for them to provide a portion of the service?

13. Does your company engage subcontractors in services provided to VHA under your BAA?

☐ Yes ☐ No

13a. If you answered “Yes” to question 13, do you have a specific, documented chain-of-custody agreement that requires the subcontractor to meet the requirements set forth in your BAA with VHA?

☐ Yes ☐ No

13b. If you answered “Yes” to question 13, do you have subcontractors who provide services to VHA that are outside of the jurisdiction of the laws of the United States?

☐ Yes ☐ No

14. Does your company destroy VHA PHI on VHA's behalf? (Including PHI that has been disclosed to your company by VHA) ☐ Yes ☐ No ☐ Return to VHA ☐ Retain for regulatory purposes ☐ Other (explain)

14a. If you answered “Yes” to question 14, does your company follow VHA’s records control schedule for destruction of these records?

☐ Yes ☐ No

15. Does your company have direct contact with VHA patients?

☐ Yes ☐ No

16. Has your company entered into other BAAs on a local/regional/VISN level with VHA?

☐ Yes ☐ No

17. Does your company receive requests from third-parties for VHA data to be disclosed by you or created by you for purposes other than defined in the BAA?

18. Has your company ever been involved in a data breach involving VHA PHI?

If you answered “Yes” to question 18, how many data breaches have you had since becoming a VHA Business Associate?

Number of Breaches: ☐ 1-5 ☐ Over 5

If you answered “Yes” to question 18, how many veterans were affected?

Number of Veterans: ☐ Less than 500 ☐ Over 500

19. Check the appropriate positions assigned within your company:

☐ Privacy Officer ☐ Information Security Officer

☐ Compliance Officer ☐ Records Manager

20. Has your company developed and documented policies and procedures that explain safeguards to prevent use or disclosure of PHI not authorized by the BAA? (Specifically policies related to Privacy, Security and Records Management) ☐ Yes ☐ No

21. Does your company have any other classification, other than Business Associate, as defined under the HIPAA Privacy and Security Rules? (e.g., Covered Entity, Hybrid Entity, etc.)

If you answered yes to this question, please enter the type of classification:

Please use this space for any additional information you would like to provide:

Company Representative Date

Privacy/Compliance Officer Date

Information Security Officer Date