Back to Index of HIPAA Changes

HIPAA Changes in H.R. 1
The American Recovery and Reinvestment Act of 2009

Business Associate Contracts Required for Certain Entities
House bill Sec. 4408
Senate bill Sec. 13408
Conference agreement Sec. 13408

This text is from the Conference Committee Report

Current Law

A covered entity (a provider, health plan, of clearinghouse) is permitted to disclose health information to a business associate or to allow a business associate to create or receive health information on its behalf, provided the covered entity receives satisfactory assurance in the form of a written contract that the business associate will appropriately safeguard the information. Current law does not explicitly include or exclude regional health information exchanges, regional health information organizations, and others offering personal health records for a covered entity from regulation under the Privacy Rule promulgated under HIPAA.

House Bill

The House bill requires organizations that contract with covered entities for the purpose of exchanging electronic health information, for example, Health Information Exchanges, Regional Health Information Organizations (RHIOs), and PHR vendors that offer their products through or for a provider or health plan, to have business associate contracts with those providers or health plans.

Senate Bill

Same provision.

Conference Agreement

Same provision.