Physician practices must review and update business associate agreements to comply with new HIPAA regulations. HIPAA requires a physician practice to enter into a written business associate agreement with any third-party contractors or vendors that may create, receive, maintain or transmit protected health information on behalf of the physician practice. These agreements describe how the business associate will use and protect the protected health information it receives from the physician practice.

The new HIPAA regulations, known as the HIPAA Omnibus Final Rule, implement many of the key provisions of the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009. These regulations broadened the definition of a "business associate," which may mean that some contractors that were not business associates in the past may now be considered business associates. Physician practices should review their third-party vendors and contractors to determine whether they are business associates and ensure that proper agreements are in place.

Business associate agreements that were already in place prior to the September 23 compliance date have one more year until September 22, 2014, to update those existing agreements.

The California Medical Association (CMA) has recently updated its business associate agreement with CMA members. In order to advocate on a member's behalf, it may be necessary for CMA staff to receive and review documentation that may include protected health information about patients. Physician practices that contact CMA for certain member services may be asked to sign a business associate agreement. CMA members who have previously signed a business associate agreement with CMA will be asked to execute an updated agreement.

If you would like a copy of CMA's updated business associate agreement with members, please contact legalinfo@cmadocs.org or (800) 786-4262.

For more information on business associate agreements and a sample business associate agreement, see CMA On-Call document #4103, "Business Associate Agreements."