{"id":24506,"date":"2020-09-22T07:00:25","date_gmt":"2020-09-22T07:00:25","guid":{"rendered":"https:\/\/www.process.st\/templates\/hipaa-business-associate-agreement-checklist\/"},"modified":"2024-02-29T02:55:31","modified_gmt":"2024-02-29T02:55:31","slug":"hipaa-business-associate-agreement-checklist","status":"publish","type":"post","link":"https:\/\/www.process.st\/templates\/hipaa-business-associate-agreement-checklist\/","title":{"rendered":"HIPAA Business Associate Agreement Checklist"},"content":{"rendered":"<section id=\"introduction\">\n<h2>Introduction:<\/h2>\n<div class=\"image-content\">\n<figure> <a href=\"https:\/\/www.process.st\/templates\/wp-content\/uploads\/2024\/02\/kAwZNxc4yf6ttjSpCRZBEQ.png\" alt=\"Introduction:\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/www.process.st\/templates\/wp-content\/uploads\/2024\/02\/kAwZNxc4yf6ttjSpCRZBEQ.png\"> <\/a><br \/>\n  <\/figure>\n<\/p><\/div>\n<div class=\"text-content\">\n<p>A Business Associate Agreement (BAA), is a <strong>written arrangement that specifies each party\u2019s responsibilities when it comes to PHI.<\/strong><\/p>\n<p>The HIPAA Privacy Rule requires all covered entities (CEs) to have a signed BAA with any Business Associate (BA) they hire that may come in contact with PHI.<\/p>\n<p>According to HHS, a BAA must include the following information:<\/p>\n<ul>\n<li>Description of the permitted and required use of PHI by the BA.<\/li>\n<li>Provide specific requirements regarding how and when the BA will not use or further disclose PHI.<\/li>\n<li>Outline requirements for the BA to use appropriate safeguards to prevent inappropriate PHI use or disclosure.<\/li>\n<\/ul>\n<p>This checklist will <strong>guide you through the process of creating and implementing a BAA.<\/strong><\/p>\n<p>As a covered entity, you will need to work in tandem with the BA to complete the agreement. <strong>This need for collaboration has been taken into account<\/strong> as the approval tasks require approval from both the CE and BA.<\/p>\n<p>This means that you can efficiently move through the process knowing that there will not be any disagreements or disruptions when it comes time to confirm and implement the agreement.<\/p>\n<p>Let's get started!<\/p>\n<h4>A little info about Process Street<\/h4>\n<p>Process Street is&nbsp;<strong>superpowered checklists<\/strong>. By using our software to document your processes, you are instantly creating an actionable workflow in which tasks can be assigned to team members, automated, and monitored in real-time to ensure they are being executed as intended, each and every time.<\/p>\n<p>The point is to&nbsp;<strong>minimize human error, increase accountability<\/strong>, and&nbsp;<strong>provide employees with all of the tools and information necessary<\/strong>&nbsp;to complete their tasks as effectively as possible.<\/p>\n<\/p><\/div>\n<\/section>\n<section id=\"enter-basic-details\">\n<h2>Enter basic details<\/h2>\n<div class=\"text-content\">\n<p>First, enter some <strong>basic details regarding the covered entity and the Business Associate (BA)<\/strong>&nbsp;with which the agreement is being made, including contact details for a main contact from each of the two parties.&nbsp;<\/p>\n<hr>\n<h4>Covered entity<\/h4>\n<\/p><\/div>\n<div class=\"text-field-content form-field-content\">\n<div class=\"form-group\"> <label> Organization Name <\/label><br \/>\n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n<\/p><\/div>\n<div class=\"text-field-content form-field-content\">\n<div class=\"form-group\"> <label> Main Contact - Name <\/label><br \/>\n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n<\/p><\/div>\n<div class=\"text-content\">\n<h4>Business Associate (BA)<\/h4>\n<\/p><\/div>\n<div class=\"text-field-content form-field-content\">\n<div class=\"form-group\"> <label> BA Organization Name <\/label><br \/>\n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n<\/p><\/div>\n<div class=\"text-field-content form-field-content\">\n<div class=\"form-group\"> <label> BA Main Contact - Name <\/label><br \/>\n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\">\n  <\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"use-and-disclosure-of-phi\">\n<h2>Use and disclosure of PHI:<\/h2>\n<\/section>\n<section id=\"describe-the-permitted-use-and-disclosure-of-phi\">\n<h2>Describe the permitted use and disclosure of PHI <\/h2>\n<div class=\"text-content\">\n<p>In the form field below, detail the<strong> permitted use and disclosure of PHI.<\/strong>&nbsp;<\/p>\n<\/p><\/div>\n<div class=\"textarea-field-content form-field-content\">\n<div class=\"form-group\"> <label> Use and disclosure of PHI <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea>\n  <\/div>\n<\/p><\/div>\n<div class=\"text-content\">\n<p class=\"style-info\">The U.S Department of Health and Human Services (HHS) only allows health care providers to share PHI if it is used to carry out health care functions. <strong>HIPAA doesn\u2019t allow PHI to be shared or sold for any independent uses or marketing purposes.<\/strong> For example, a business associate can\u2019t use PHI in their email campaigns.<\/p>\n<\/p><\/div>\n<\/section>\n<section id=\"define-under-what-circumstances-the-ba-must-disclose-phi\">\n<h2>Define under what circumstances the BA must disclose PHI<\/h2>\n<div class=\"text-content\">\n<p>Detail under what <strong>circumstances the Business Associate (BA) must disclose PHI.<\/strong><\/p>\n<\/p><\/div>\n<div class=\"textarea-field-content form-field-content\">\n<div class=\"form-group\"> <label> Circumstances under which the BA must disclose PHI <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea>\n  <\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"approval-use-and-disclosure-of-phi\">\n<h2>Approval: Use and disclosure of PHI<\/h2>\n<div class=\"approval-content\">\n<div class=\"header\">\n<div class=\"list-title\">\n    Will be submitted for approval:\n   <\/div>\n<\/p><\/div>\n<div class=\"approval-rule-subject-tasks-list\">\n<ul class=\"list\">\n<li>\n<div class=\"approval-rule-subject-tasks-list-item\">\n<div class=\"item\">\n<div class=\"container\"> <span class=\"title\">Describe the permitted use and disclosure of PHI <\/span> <\/p>\n<div class=\"body\">\n         Will be submitted\n        <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/li>\n<li>\n<div class=\"approval-rule-subject-tasks-list-item\">\n<div class=\"item\">\n<div class=\"container\"> <span class=\"title\">Define under what circumstances the BA must disclose PHI<\/span> <\/p>\n<div class=\"body\">\n         Will be submitted\n        <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/li>\n<\/ul><\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"breach-reporting-and-phi-destruction\">\n<h2>Breach reporting and PHI destruction:<\/h2>\n<\/section>\n<section id=\"specify-how-and-when-the-ba-must-report-any-accidental-disclosures-of-phi\">\n<h2>Specify how and when the BA must report any accidental disclosures of PHI<\/h2>\n<div class=\"image-content\">\n<figure> <a href=\"https:\/\/www.process.st\/templates\/wp-content\/uploads\/2024\/02\/krONRAfFAWiyXbh_6VpCAw.jpg\" alt=\"Specify how and when the BA must report any accidental disclosures of PHI\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/www.process.st\/templates\/wp-content\/uploads\/2024\/02\/krONRAfFAWiyXbh_6VpCAw.jpg\"> <\/a><br \/>\n  <\/figure>\n<\/p><\/div>\n<div class=\"text-content\">\n<p>If a security breach were to occur, the BA you are working with needs to have specific rules to follow regarding <strong>when and how the breach is reported<\/strong> to the covered entity.<\/p>\n<p>In the form field below, state what these rules are, i.e. when and how the breach must be reported.<\/p>\n<\/p><\/div>\n<div class=\"textarea-field-content form-field-content\">\n<div class=\"form-group\"> <label> Reporting requirements for accidental disclosures of PHI (when and how) <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea>\n  <\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"specify-how-and-when-the-ba-is-to-return-or-effectively-destroy-all-patient-phi\">\n<h2>Specify how and when the BA is to return or effectively destroy all patient PHI<\/h2>\n<div class=\"text-content\">\n<p>There will be circumstances in which the BA will need to <strong>either return or destroy all patient PHI <\/strong>(e.g. at the patient's request).&nbsp;<\/p>\n<p>These circumstances need to be <strong>clarified and formally documented<\/strong> so that the BA can carry out the procedure and avoid unnecessary and costly delays.&nbsp;<\/p>\n<\/p><\/div>\n<div class=\"textarea-field-content form-field-content\">\n<div class=\"form-group\"> <label> Return or desctruction of PHI (when and how) <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea>\n  <\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"approval-phi-breach-reporting-and-destruction-procedures\">\n<h2>Approval: PHI breach reporting and destruction procedures<\/h2>\n<div class=\"approval-content\">\n<div class=\"header\">\n<div class=\"list-title\">\n    Will be submitted for approval:\n   <\/div>\n<\/p><\/div>\n<div class=\"approval-rule-subject-tasks-list\">\n<ul class=\"list\">\n<li>\n<div class=\"approval-rule-subject-tasks-list-item\">\n<div class=\"item\">\n<div class=\"container\"> <span class=\"title\">Specify how and when the BA is to return or effectively destroy all patient PHI<\/span> <\/p>\n<div class=\"body\">\n         Will be submitted\n        <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/li>\n<li>\n<div class=\"approval-rule-subject-tasks-list-item\">\n<div class=\"item\">\n<div class=\"container\"> <span class=\"title\">Specify how and when the BA must report any accidental disclosures of PHI<\/span> <\/p>\n<div class=\"body\">\n         Will be submitted\n        <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/li>\n<\/ul><\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"security-rule-risk-analysis\">\n<h2>Security rule risk analysis:<\/h2>\n<\/section>\n<section id=\"conduct-a-risk-analysis-of-it-systems\">\n<h2>Conduct a risk analysis of IT systems<\/h2>\n<div class=\"image-content\">\n<figure> <a href=\"https:\/\/www.process.st\/templates\/wp-content\/uploads\/2024\/02\/s_Js-6oho0QelUHMFXZIZA.jpg\" alt=\"Conduct a risk analysis of IT systems\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/www.process.st\/templates\/wp-content\/uploads\/2024\/02\/s_Js-6oho0QelUHMFXZIZA.jpg\"> <\/a><br \/>\n  <\/figure>\n<\/p><\/div>\n<div class=\"text-content\">\n<p>Under the HIPAA Security Rule, both health care organizations and the BA's they partner with <strong>must perform and document a risk analysis<\/strong> of their network and IT systems to identify risks.<\/p>\n<p>In the form field below, <strong>note down the risks that were identified<\/strong> during the analysis so that they can be <strong>evaluated and have appropriate safeguards put in place<\/strong> for risk mitigation.<\/p>\n<p>You can also <strong>attach and\/or link to<\/strong> risk analysis documentation below.&nbsp;<\/p>\n<\/p><\/div>\n<div class=\"textarea-field-content form-field-content\">\n<div class=\"form-group\"> <label> IT systems risk analysis - Identified risks <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea>\n  <\/div>\n<\/p><\/div>\n<div class=\"file-field-content form-field-content\">\n<div class=\"form-group\"> <label> IT systems risk analysis (file) <\/label> <\/p>\n<div class=\"file-container\"> <button type=\"button\" disabled class=\"btn btn-default\"> <i class=\"fa fa-upload btn-icon\"><\/i> File will be uploaded here <\/button>\n   <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"describe-the-safeguards-that-have-been-implemented\">\n<h2>Describe the safeguards that have been implemented<\/h2>\n<div class=\"text-content\">\n<p>Below are the risks that you identified during the IT systems risk analysis<\/p>\n<h4>Identified risks<\/h4>\n<p><strong>{{form.IT_systems_risk_analysis_-_Identified_risks}}<\/strong><\/p>\n<hr>\n<p>Now, <strong>describe the safeguards that have been put in place<\/strong> to mitigate these risks.&nbsp;<\/p>\n<p>You can also <strong>attach and\/or link to<\/strong> relevant documentation below.&nbsp;<\/p>\n<\/p><\/div>\n<div class=\"textarea-field-content form-field-content\">\n<div class=\"form-group\"> <label> IT safeguards that have been implemented <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea>\n  <\/div>\n<\/p><\/div>\n<div class=\"file-field-content form-field-content\">\n<div class=\"form-group\"> <label> IT safeguards that have been implemented (file) <\/label> <\/p>\n<div class=\"file-container\"> <button type=\"button\" disabled class=\"btn btn-default\"> <i class=\"fa fa-upload btn-icon\"><\/i> File will be uploaded here <\/button>\n   <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"approval-security-rule-risk-analysis\">\n<h2>Approval: Security rule risk analysis<\/h2>\n<div class=\"approval-content\">\n<div class=\"header\">\n<div class=\"list-title\">\n    Will be submitted for approval:\n   <\/div>\n<\/p><\/div>\n<div class=\"approval-rule-subject-tasks-list\">\n<ul class=\"list\">\n<li>\n<div class=\"approval-rule-subject-tasks-list-item\">\n<div class=\"item\">\n<div class=\"container\"> <span class=\"title\">Describe the safeguards that have been implemented<\/span> <\/p>\n<div class=\"body\">\n         Will be submitted\n        <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/li>\n<li>\n<div class=\"approval-rule-subject-tasks-list-item\">\n<div class=\"item\">\n<div class=\"container\"> <span class=\"title\">Conduct a risk analysis of IT systems<\/span> <\/p>\n<div class=\"body\">\n         Will be submitted\n        <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/li>\n<\/ul><\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"cyber-security-training\">\n<h2>Cyber security training:<\/h2>\n<\/section>\n<section id=\"conduct-user-training\">\n<h2>Conduct user training <\/h2>\n<div class=\"text-content\">\n<p>Employees at the BA need to be taken through <strong>security awareness training<\/strong> so they know how to securely manage PHI and can carry out the relevant procedures depending on what the circumstances are.&nbsp;<\/p>\n<\/p><\/div>\n<div class=\"textarea-field-content form-field-content\">\n<div class=\"form-group\"> <label> User training plan\/program <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea>\n  <\/div>\n<\/p><\/div>\n<div class=\"file-field-content form-field-content\">\n<div class=\"form-group\"> <label> User training plan\/program (file) <\/label> <\/p>\n<div class=\"file-container\"> <button type=\"button\" disabled class=\"btn btn-default\"> <i class=\"fa fa-upload btn-icon\"><\/i> File will be uploaded here <\/button>\n   <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"document-training-records\">\n<h2>Document training records<\/h2>\n<div class=\"text-content\">\n<p>Training records need to be<strong> documented for legal compliance and so that they are accessible<\/strong> in the case that prior training needs to be reviewed.&nbsp;<\/p>\n<p>Its also vital that you document training records because it provides an opportunity for <strong>continuous improvement and optimization of user onboarding<\/strong> and training.&nbsp;<\/p>\n<p>You can <strong>attach and\/or link to training records<\/strong> below.&nbsp;<\/p>\n<\/p><\/div>\n<div class=\"file-field-content form-field-content\">\n<div class=\"form-group\"> <label> Training records (file) <\/label> <\/p>\n<div class=\"file-container\"> <button type=\"button\" disabled class=\"btn btn-default\"> <i class=\"fa fa-upload btn-icon\"><\/i> File will be uploaded here <\/button>\n   <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"approval-training-completed--documented\">\n<h2>Approval: Training completed &amp; documented<\/h2>\n<div class=\"approval-content\">\n<div class=\"header\">\n<div class=\"list-title\">\n    Will be submitted for approval:\n   <\/div>\n<\/p><\/div>\n<div class=\"approval-rule-subject-tasks-list\">\n<ul class=\"list\">\n<li>\n<div class=\"approval-rule-subject-tasks-list-item\">\n<div class=\"item\">\n<div class=\"container\"> <span class=\"title\">Document training records<\/span> <\/p>\n<div class=\"body\">\n         Will be submitted\n        <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/li>\n<li>\n<div class=\"approval-rule-subject-tasks-list-item\">\n<div class=\"item\">\n<div class=\"container\"> <span class=\"title\">Conduct user training <\/span> <\/p>\n<div class=\"body\">\n         Will be submitted\n        <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/li>\n<\/ul><\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"terminating-the-agreement\">\n<h2>Terminating the agreement:<\/h2>\n<\/section>\n<section id=\"specify-your-rights-to-terminate-the-baa\">\n<h2>Specify your rights to terminate the BAA<\/h2>\n<div class=\"text-content\">\n<p>As the covered entity, you must <strong>specify your rights to terminate the agreement.&nbsp;<\/strong><\/p>\n<p class=\"style-warning\">Also, be sure to <strong>i<\/strong><strong>ndicate the BA\u2019s obligations<\/strong> upon termination.<\/p>\n<\/p><\/div>\n<div class=\"textarea-field-content form-field-content\">\n<div class=\"form-group\"> <label> Rights to terminate the BAA <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea>\n  <\/div>\n<\/p><\/div>\n<div class=\"textarea-field-content form-field-content\">\n<div class=\"form-group\"> <label> BA's obligations upon termination <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea>\n  <\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"approval-termination-rights--obligations\">\n<h2>Approval: Termination rights &amp; obligations<\/h2>\n<div class=\"approval-content\">\n<div class=\"header\">\n<div class=\"list-title\">\n    Will be submitted for approval:\n   <\/div>\n<\/p><\/div>\n<div class=\"approval-rule-subject-tasks-list\">\n<ul class=\"list\">\n<li>\n<div class=\"approval-rule-subject-tasks-list-item\">\n<div class=\"item\">\n<div class=\"container\"> <span class=\"title\">Specify your rights to terminate the BAA<\/span> <\/p>\n<div class=\"body\">\n         Will be submitted\n        <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/li>\n<\/ul><\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"final-steps\">\n<h2>Final steps:<\/h2>\n<\/section>\n<section id=\"copy-and-file-the-baa\">\n<h2>Copy and file the BAA<\/h2>\n<div class=\"image-content\">\n<figure> <a href=\"https:\/\/www.process.st\/templates\/wp-content\/uploads\/2024\/02\/ul1RqJ_GwRD3XXEdDqNBag.jpg\" alt=\"Copy and file the BAA\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/www.process.st\/templates\/wp-content\/uploads\/2024\/02\/ul1RqJ_GwRD3XXEdDqNBag.jpg\"> <\/a><br \/>\n  <\/figure>\n<\/p><\/div>\n<div class=\"text-content\">\n<p>Copy and file the BAA.<\/p>\n<p>You can<strong> attach and\/or link to<\/strong> the agreement below.&nbsp;<\/p>\n<\/p><\/div>\n<div class=\"file-field-content form-field-content\">\n<div class=\"form-group\"> <label> Finalized BAA (file) <\/label> <\/p>\n<div class=\"file-container\"> <button type=\"button\" disabled class=\"btn btn-default\"> <i class=\"fa fa-upload btn-icon\"><\/i> File will be uploaded here <\/button>\n   <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"set-date-to-review-the-baa\">\n<h2>Set date to review the BAA<\/h2>\n<div class=\"text-content\">\n<p>Set a date to review the BAA.&nbsp;<\/p>\n<p class=\"style-info\">Ideally, this would be <strong>once a month, or at least once a quarter.<\/strong><\/p>\n<\/p><\/div>\n<div class=\"date-field-content form-field-content\">\n<div class=\"form-group\"> <label> Date to review BAA <\/label> <\/p>\n<div class=\"date-container\"> <button type=\"button\" disabled class=\"btn btn-default\"> <i class=\"fa fa-calendar btn-icon\"><\/i> Date will be set here <\/button>\n   <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"approval-baa-finalized--implemented\">\n<h2>Approval: BAA finalized &amp; implemented<\/h2>\n<div class=\"approval-content\">\n<div class=\"header\">\n<div class=\"list-title\">\n    Will be submitted for approval:\n   <\/div>\n<\/p><\/div>\n<div class=\"approval-rule-subject-tasks-list\">\n<ul class=\"list\">\n<li>\n<div class=\"approval-rule-subject-tasks-list-item\">\n<div class=\"item\">\n<div class=\"container\"> <span class=\"title\">Set date to review the BAA<\/span> <\/p>\n<div class=\"body\">\n         Will be submitted\n        <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/li>\n<li>\n<div class=\"approval-rule-subject-tasks-list-item\">\n<div class=\"item\">\n<div class=\"container\"> <span class=\"title\">Copy and file the BAA<\/span> <\/p>\n<div class=\"body\">\n         Will be submitted\n        <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/li>\n<\/ul><\/div>\n<\/p><\/div>\n<\/section>\n<section id=\"sources\">\n<h2>Sources:<\/h2>\n<div class=\"text-content\">\n<ul>\n<li><a href=\"https:\/\/www.anetworks.com\/\" rel=\"nofollow noopener\" target=\"_blank\">aNetworks<\/a> - <a href=\"https:\/\/www.anetworks.com\/hipaa-baa-checklist\/\" rel=\"nofollow noopener\" target=\"_blank\">HIPAA BAA Checklist<\/a><\/li>\n<li><a href=\"https:\/\/hipaa-guard.com\/\" rel=\"nofollow noopener\" target=\"_blank\">HIPAA Guard<\/a> -&nbsp; <a href=\"https:\/\/hipaa-guard.com\/the-hipaa-business-associate-agreement-checklist\/\" rel=\"nofollow noopener\" target=\"_blank\">The HIPAA Business Associate Agreement Checklist<\/a><\/li>\n<li><a href=\"https:\/\/www.hollandhart.com\/kcstanger\" rel=\"nofollow noopener\" target=\"_blank\">Kim Stanger<\/a> - <a href=\"https:\/\/www.hollandhart.com\/checklist_for_hipaa_business_associate_agreements\" rel=\"nofollow noopener\" target=\"_blank\">Checklist for HIPAA Business Associate Agreements<\/a><\/li>\n<li><a href=\"https:\/\/hipaatrek.com\/author\/hernan\/\" rel=\"nofollow noopener\" target=\"_blank\">Hernan Serrano<\/a> - <a href=\"https:\/\/hipaatrek.com\/7-facts-hipaa-business-associate-agreements\/\" rel=\"nofollow noopener\" target=\"_blank\">7 Quick Facts About HIPAA Business Associate Agreements<\/a><\/li>\n<li><a href=\"https:\/\/www.totalhipaa.com\/\" rel=\"nofollow noopener\" target=\"_blank\">Total HIPAA<\/a> - <a href=\"https:\/\/www.totalhipaa.com\/business-associate-agreement-101\/\" rel=\"nofollow noopener\" target=\"_blank\">Business Associate Agreement: Everything Explained<\/a><\/li>\n<li><a href=\"https:\/\/www.hhs.gov\/\" rel=\"nofollow noopener\" target=\"_blank\">HHS<\/a> - <a href=\"https:\/\/www.hhs.gov\/hipaa\/for-professionals\/privacy\/guidance\/business-associates\/index.html\" rel=\"nofollow noopener\" target=\"_blank\">Business Associates<\/a><\/li>\n<li><a href=\"https:\/\/www.accountablehq.com\/\" rel=\"nofollow noopener\" target=\"_blank\">Accountable<\/a> - <a href=\"https:\/\/www.accountablehq.com\/post\/business-associate-agreement\" rel=\"nofollow noopener\" target=\"_blank\">What is a Business Associate Agreement? All About BAAs<\/a><\/li>\n<li><a href=\"https:\/\/www.complyassistant.com\/\" rel=\"nofollow noopener\" target=\"_blank\">ComplyAssistant<\/a> - <a href=\"https:\/\/www.complyassistant.com\/resources\/tools\/business-associate-agreement\/\" rel=\"nofollow noopener\" target=\"_blank\">HIPAA Business Associate Agreement Template<\/a><\/li>\n<\/ul><\/div>\n<\/section>\n<section id=\"related-checklists\">\n<h2>Related checklists:<\/h2>\n<div class=\"text-content\">\n<ul>\n<li><a href=\"https:\/\/www.process.st\/templates\/hipaa-compliance-checklist-for-hr\/\" rel=\"nofollow noopener\" target=\"_blank\">HIPAA Compliance Checklist for HR<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/hipaa-compliance-checklist-for-hr\/\" rel=\"nofollow noopener\" target=\"_blank\">HIPAA Privacy Risk Assessment Checklist<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/hipaa-compliance-checklist-for-hr\/\" rel=\"nofollow noopener\" target=\"_blank\">HIPAA Security Breach Reporting Checklist<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/hipaa-compliance-checklist-for-hr\/\" rel=\"nofollow noopener\" target=\"_blank\">HIPAA Data Backup Plan Checklist<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/hipaa-compliance-checklist-for-hr\/\" rel=\"nofollow noopener\" target=\"_blank\">HIPAA Omnibus Rule Checklist<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/hipaa-compliance-checklist-for-hr\/\" rel=\"nofollow noopener\" target=\"_blank\">Patient Intake Checklist for a Medical Clinic<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/hipaa-compliance-checklist-for-hr\/\" rel=\"nofollow noopener\" target=\"_blank\">Patient Intake Checklist for a Dental Clinic<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/hipaa-compliance-checklist-for-hr\/\" rel=\"nofollow noopener\" target=\"_blank\">Patient Satisfaction Survey Checklist<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/hospital-housekeeping-checklist\/\" rel=\"nofollow noopener\" target=\"_blank\">Hospital Housekeeping Checklist<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/terminal-room-cleaning-checklist\/\" rel=\"nofollow noopener\" target=\"_blank\">Terminal Room Cleaning Checklist<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/hospital-safety-inspection-checklist\/\" rel=\"nofollow noopener\" target=\"_blank\">Hospital Safety Inspection Checklist<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/general-infection-control-checklist\/\" rel=\"nofollow noopener\" target=\"_blank\">General Infection Control Checklist<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/patient-satisfaction-survey-checklist\/\" rel=\"nofollow noopener\" target=\"_blank\">Patient Satisfaction Survey Checklist<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/home-visit-checklist\/\" rel=\"nofollow noopener\" target=\"_blank\">Home Visit Checklist<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/mental-health-risk-assessment-checklist\/\" rel=\"nofollow noopener\" target=\"_blank\">Mental Health Risk Assessment Checklist<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/who-surgical-safety-checklist\/\" rel=\"nofollow noopener\" target=\"_blank\">WHO Surgical Safety Checklist<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/hipaa-compliance-checklist\/\" rel=\"nofollow noopener\" target=\"_blank\">HIPAA Compliance Checklist<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/covid-19-procedure-isolation-area-management\/\" rel=\"nofollow noopener\" target=\"_blank\">COVID-19 Procedure: Isolation Area Management<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/covid-19-procedure-disinfection-procedures-for-covid-19-isolation-ward-area\/\" rel=\"nofollow noopener\" target=\"_blank\">COVID-19 Procedure: Disinfection Procedures for COVID-19 Isolation Ward Area<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/covid-19-procedure-lung-transplantation-pre-transplantation-assessment\/\" rel=\"nofollow noopener\" target=\"_blank\">COVID-19 Procedure: Lung Transplantation Pre-Transplantation Assessment<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/covid-19-procedure-nursing-care-during-treatment-alss\/\" rel=\"nofollow noopener\" target=\"_blank\">COVID-19 Procedure: Nursing Care During Treatment (ALSS)<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/covid-19-procedure-protocol-for-donning-and-removing-ppe\/\" rel=\"nofollow noopener\" target=\"_blank\">COVID-19 Procedure: Protocol for Donning and Removing PPE<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/covid-19-procedure-staff-management-workflow-and-health\/\" rel=\"nofollow noopener\" target=\"_blank\">COVID-19 Procedure: Staff Management (Workflow and Health)<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/covid-19-procedure-daily-management-and-monitoring-of-ecmo-audit\/\" rel=\"nofollow noopener\" target=\"_blank\">COVID-19 Procedure: Daily Management and Monitoring of ECMO Audit<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/covid-19-procedure-digital-support-for-epidemic-prevention-and-control\/\" rel=\"nofollow noopener\" target=\"_blank\">COVID-19 Procedure: Digital Support for Epidemic Prevention and Control<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/covid-19-procedure-discharge-standards-and-follow-up-plan-for-covid-19-patients\/\" rel=\"nofollow noopener\" target=\"_blank\">COVID-19 Procedure: Discharge Standards and Follow-up Plan for COVID-19 Patients<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/covid-19-procedure-disinfection-of-covid-19-related-reusable-medical-devices\/\" rel=\"nofollow noopener\" target=\"_blank\">COVID-19 Procedure: Disinfection of COVID-19 Related Reusable Medical Devices<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/covid-19-procedure-disinfection-procedures-for-infectious-fabrics-of-suspected-or-confirmed-patients\/\" rel=\"nofollow noopener\" target=\"_blank\">COVID-19 Procedure: Disinfection Procedures for Infectious Fabrics of Suspected or Confirmed Patients<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/covid-19-procedure-disposal-procedures-for-covid-19-related-medical-waste\/\" rel=\"nofollow noopener\" target=\"_blank\">COVID-19 Procedure: Disposal Procedures for COVID-19 Related Medical Waste<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/covid-19-procedure-disposal-procedures-for-spills-of-covid-19-patient-blood-fluids\/\" rel=\"nofollow noopener\" target=\"_blank\">COVID-19 Procedure: Disposal Procedures for Spills of COVID-19 Patient Blood\/Fluids<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/covid-19-procedure-procedures-for-handling-bodies-of-deceased-suspected-or-confirmed-patients\/\" rel=\"nofollow noopener\" target=\"_blank\">COVID-19 Procedure: Procedures for Handling Bodies of Deceased Suspected or Confirmed Patients<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/covid-19-procedure-procedures-for-taking-remedial-actions-against-occupational-exposure-to-covid-19\/\" rel=\"nofollow noopener\" target=\"_blank\">COVID-19 Procedure: Procedures for Taking Remedial Actions against Occupational Exposure to COVID-19<\/a><\/li>\n<li><a href=\"https:\/\/www.process.st\/templates\/covid-19-procedure-surgical-operations-for-suspected-or-confirmed-patients\/\" rel=\"nofollow noopener\" target=\"_blank\">COVID-19 Procedure: Surgical Operations for Suspected or Confirmed Patients<\/a><\/li>\n<\/ul><\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"<p>Introduction: A Business Associate Agreement (BAA), is a written arrangement that specifies each party\u2019s responsibilities when it comes to PHI. The HIPAA Privacy Rule requires all covered entities (CEs) to have a signed BAA with any Business Associate (BA) they hire that may come in contact with PHI. According to HHS, a BAA must include [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":24507,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"ep_exclude_from_search":false,"cover_icon_emoji":"","cover_icon_url":"","tasks_count":"27","template_description":"Run this checklist to create and implement a HIPAA compliant business associate agreement","template_id":"te0bbYjl0XtOo8fS4yZMXg","task_0":"Introduction:","task_slug_0":"introduction","task_1":"Enter basic details","task_slug_1":"enter-basic-details","task_2":"Use and disclosure of PHI:","task_slug_2":"use-and-disclosure-of-phi","task_3":"Describe the permitted use and disclosure of PHI","task_slug_3":"describe-the-permitted-use-and-disclosure-of-phi","task_4":"Define under what circumstances the BA must disclose PHI","task_slug_4":"define-under-what-circumstances-the-ba-must-disclose-phi","task_5":"Approval: Use and disclosure of PHI","task_slug_5":"approval-use-and-disclosure-of-phi","task_6":"Breach reporting and PHI destruction:","task_slug_6":"breach-reporting-and-phi-destruction","task_7":"Specify how and when the BA must report any accidental disclosures of PHI","task_slug_7":"specify-how-and-when-the-ba-must-report-any-accidental-disclosures-of-phi","task_8":"Specify how and when the BA is to return or effectively destroy all patient PHI","task_slug_8":"specify-how-and-when-the-ba-is-to-return-or-effectively-destroy-all-patient-phi","task_9":"Approval: PHI breach reporting and destruction procedures","task_slug_9":"approval-phi-breach-reporting-and-destruction-procedures","task_10":"Security rule risk analysis:","task_slug_10":"security-rule-risk-analysis","task_11":"Conduct a risk analysis of IT systems","task_slug_11":"conduct-a-risk-analysis-of-it-systems","task_12":"Describe the safeguards that have been implemented","task_slug_12":"describe-the-safeguards-that-have-been-implemented","task_13":"Approval: Security rule risk analysis","task_slug_13":"approval-security-rule-risk-analysis","task_14":"Cyber security training:","task_slug_14":"cyber-security-training","task_15":"Conduct user training","task_slug_15":"conduct-user-training","task_16":"Document training records","task_slug_16":"document-training-records","task_17":"Approval: Training completed &amp; documented","task_slug_17":"approval-training-completed--documented","task_18":"Terminating the agreement:","task_slug_18":"terminating-the-agreement","task_19":"Specify your rights to terminate the BAA","task_slug_19":"specify-your-rights-to-terminate-the-baa","task_20":"Approval: Termination rights &amp; obligations","task_slug_20":"approval-termination-rights--obligations","task_21":"Final steps:","task_slug_21":"final-steps","task_22":"Copy and file the BAA","task_slug_22":"copy-and-file-the-baa","task_23":"Set date to review the BAA","task_slug_23":"set-date-to-review-the-baa","task_24":"Approval: BAA finalized &amp; implemented","task_slug_24":"approval-baa-finalized--implemented","task_25":"Sources:","task_slug_25":"sources","task_26":"Related checklists:","task_slug_26":"related-checklists","task_27":"","task_slug_27":"","task_28":"","task_slug_28":"","task_29":"","task_slug_29":"","task_30":"","task_slug_30":"","task_31":"","task_slug_31":"","task_32":"","task_slug_32":"","task_33":"","task_slug_33":"","task_34":"","task_slug_34":"","task_35":"","task_slug_35":"","task_36":"","task_slug_36":"","task_37":"","task_slug_37":"","task_38":"","task_slug_38":"","task_39":"","task_slug_39":"","task_40":"","task_slug_40":"","task_41":"","task_slug_41":"","task_42":"","task_slug_42":"","task_43":"","task_slug_43":"","task_44":"","task_slug_44":"","task_45":"","task_slug_45":"","task_46":"","task_slug_46":"","task_47":"","task_slug_47":"","task_48":"","task_slug_48":"","task_49":"","task_slug_49":"","task_50":"","task_slug_50":"","task_51":"","task_slug_51":"","task_52":"","task_slug_52":"","task_53":"","task_slug_53":"","task_54":"","task_slug_54":"","task_55":"","task_slug_55":"","task_56":"","task_slug_56":"","task_57":"","task_slug_57":"","task_58":"","task_slug_58":"","task_59":"","task_slug_59":"","task_60":"","task_slug_60":"","task_61":"","task_slug_61":"","task_62":"","task_slug_62":"","task_63":"","task_slug_63":"","task_64":"","task_slug_64":"","task_65":"","task_slug_65":"","task_66":"","task_slug_66":"","task_67":"","task_slug_67":"","task_68":"","task_slug_68":"","task_69":"","task_slug_69":"","task_70":"","task_slug_70":"","task_71":"","task_slug_71":"","task_72":"","task_slug_72":"","task_73":"","task_slug_73":"","task_74":"","task_slug_74":"","task_75":"","task_slug_75":"","task_76":"","task_slug_76":"","task_77":"","task_slug_77":"","task_78":"","task_slug_78":"","task_79":"","task_slug_79":"","task_80":"","task_slug_80":"","task_81":"","task_slug_81":"","task_82":"","task_slug_82":"","task_83":"","task_slug_83":"","task_84":"","task_slug_84":"","task_85":"","task_slug_85":"","task_86":"","task_slug_86":"","task_87":"","task_slug_87":"","task_88":"","task_slug_88":"","task_89":"","task_slug_89":"","task_90":"","task_slug_90":"","task_91":"","task_slug_91":"","task_92":"","task_slug_92":"","task_93":"","task_slug_93":"","task_94":"","task_slug_94":"","task_95":"","task_slug_95":"","task_96":"","task_slug_96":"","task_97":"","task_slug_97":"","task_98":"","task_slug_98":"","task_99":"","task_slug_99":"","footnotes":""},"categories":[29,7],"tags":[],"class_list":["post-24506","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-healthcare","category-miscellaneous"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/posts\/24506","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/comments?post=24506"}],"version-history":[{"count":0,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/posts\/24506\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/media\/24507"}],"wp:attachment":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/media?parent=24506"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/categories?post=24506"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/tags?post=24506"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}