Short answer: It must limit the business associate’s uses of PHI, require safeguards and Security Rule compliance, require reporting of improper uses, security incidents and breaches, bind subcontractors, support individuals’ rights, open records to HHS, require return or destruction of PHI, and let the plan terminate for a material breach.
The required terms of a business associate agreement include that the business associate will:
- use or disclose PHI only as the contract permits or law requires;
- use appropriate safeguards and comply with the Security Rule for electronic PHI;
- report uses or disclosures not allowed by the contract, any security incident, and breaches of unsecured PHI;
- make subcontractors that handle the PHI agree to the same restrictions;
- make PHI available for individuals’ access, amendment and accounting requests;
- make its books and records available to HHS;
- return or destroy the PHI at the end of the contract if feasible.
The contract must also let the plan end it if the business associate materially violates it. If the plan knows of a pattern of violations, it must take reasonable steps to cure them and, if that fails, end the contract where feasible.
Practical points: negotiate a breach-reporting window much shorter than the 60 days the rule allows, and sign the agreement before PHI changes hands, since a late signature does not fix earlier disclosures.