Section § 164.314(a)(1)Business associate contracts or other arrangements

What it says

(a)(1) Standard: Business associate contracts or other arrangements. The contract or other arrangement required by § 164.308(b)(3) must meet the requirements of paragraph (a)(2)(i), (a)(2)(ii), or (a)(2)(iii) of this section, as applicable.

(2) Implementation specifications (Required)—(i) Business associate contracts. The contract must provide that the business associate will—

(A) Comply with the applicable requirements of this subpart;

(B) In accordance with § 164.308(b)(2), ensure that any subcontractors that create, receive, maintain, or transmit electronic protected health information on behalf of the business associate agree to comply with the applicable requirements of this subpart by entering into a contract or other arrangement that complies with this section; and

(C) Report to the covered entity any security incident of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410.

(ii) Other arrangements. The covered entity is in compliance with paragraph (a)(1) of this section if it has another arrangement in place that meets the requirements of § 164.504(e)(3).

(iii) Business associate contracts with subcontractors. The requirements of paragraphs (a)(2)(i) and (a)(2)(ii) of this section apply to the contract or other arrangement between a business associate and a subcontractor required by § 164.308(b)(4) in the same manner as such requirements apply to contracts or other arrangements between a covered entity and business associate.

HIPAA, the United States rules protecting health information, § 164.314(a)(1)

What is in the packs for this

From HIPAA Security Rule Readiness. Each one helps with this requirement.

• XLSExcel

  Security Rule Safeguard Register

  Its Framework References cite this section. Lists the 22 Security Rule standards and their 41 implementation specifications in plain words, required or addressable, with an owner and the evidence to keep.
• DOCWord

  Business Associate Agreement Security Terms

  Its Framework References cite this section. Gives the security team the terms to check in a business associate agreement, each with its source and a pointer to the supplier clause library. It is not a legal template.