No. There seems to be a common misunderstanding about the sample business associate agreements (BAA) provided by Department of Health and Human Services (HHS).
Some are under the impression that, the BAA must be in the sample form provided by HHS. As a result, during business associate contract negotiations, some covered entities, business associates, and subcontractors (or their attorneys, privacy officers, security officers, etc.) push back on certain terms and limitations because they believe that all of the language provided in a sample agreement 'must' be included.

While it is certainly true that the HIPAA Privacy Rule and Security Rule do require that certain business associate related language be included in BAAs, this does not mean that every term set forth in the sample agreements provided by HHS must also be included.		 

HHS has itself clarified this issue in the HIPAA Omnibus Rule released on January 25, 2013 (formally titled: "Modifications to the HIPAA Privacy, Security, Enforcement, and Breach
Notification Rules Under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules; Final Rule"):
"Finally, in response to the comments requesting a model business associate agreement, we note that the Department has published sample business associate provisions on its web site. The sample language is designed to help covered entities comply with the business associate agreement requirements of the Privacy and Security Rules. However, use of these sample provisions is not required for compliance with the Rules, and the language should be amended as appropriate to reflect actual business arrangements between the covered entity and the business associate (or a business associate and a subcontractor)."
78 FR 5601 (Jan. 25, 2013).

If your organization receives push back or the opposing counsel (or privacy officer, security officer, etc.) insists that the HHS sample BAA must be used in the exact form, please feel free to quote the language above.

If you need help negotiating a business associate agreement for your organization, please contact us. We have negotiated a number of BAAs with covered entities, business associates, and subcontractors.



This FAQ post, and the information on this website, has been prepared for general information purposes only. The information on this website is not legal advice. Legal advice is dependent upon the specific circumstances of each situation and the jurisdiction of each state. The information contained here is not guaranteed to be up to date. Please consult legal counsel in your state to discuss your specific circumstances.