American Medical Association Business Associates Audio Teleconference March 27, 2002

1
American Medical AssociationBusiness
AssociatesAudio TeleconferenceMarch 27, 2002

• John R. Christiansen, Of Counsel
• Preston Gates Ellis LLP
• 701 Fifth Avenue, Suite 5000
• Seattle, WA 98012
• Phone [phone]
• Email johnc_at_prestongates.com

2
Presenter Qualifications

• John R. Christiansen
• Chair, Technology Security Practice Group
• Member, Healthcare Practice Group
• Privacy, Security and HIPAA Compliance and Risk
  Management
• Technology Acquisition/Sale and Management,
  Strategic IT Relationships
• Technology Companies, Healthcare Providers,
  Health Plans
• National Leadership Roles
• Co-Chair, ABA Healthcare Informatics Committee
• Co-Chair, HIPAS Task Group of ABA Information
  Security Committee
• Author, Electronic Health Information Privacy and
  Security Compliance Under HIPAA (AHLA 2000)
• Professor, Law and Ethics, Oregon Health
  Sciences University School of Medicine Division
  of Informatics

3
Major BAC Issues

• Preparing for BAC Contracting
• Identify your existing BAs and review your
  existing contracts
• Do they extend past April 13, 2003?
• If so how can they be amended?
• What happens if your BA wont amend?
• Will you be in breach if you stop providing
  information?
• What will you have to do if your BA stops
  performing?
• Who represents the BA in contract matters?
• What, if anything, is the BA communicating about
  its BA-related planning?
• Who has the authority to negotiate with BAs for
  your practice?
• Does s/he understand HIPAA and the BAC concept?
• How is your legal counsel involved?
• How well does s/he understand HIPAA and the BAC
  concept?
• What kind of due diligence do you want to
  conduct, and why?

4
Major BAC Issues

• Drafting Issues
• When will you also need to have a Chain of Trust
  Agreement (Security Rule) and/or Trading Partner
  Agreement (Transactions Rule) with the same
  party?
• What other agreements (services, etc.) do you
  need to have with the same party?
• When and how can you combine different
  agreements? When should you?
• What other provisions should you include in a
  BAC? E.g. indemnification, dispute resolution,
  data ownership?
• What level of generality do you want in
  provisions?
• Should you specify enhanced limitations on
  information use for some kinds of data (AIDS,
  etc.)?
• The definition of services for each BA will need
  to fit conditions permitting HIPAA disclosure
• Etc.

5
Major BAC Issues

• Contract Management
• How many BAs will you have?
• Will you be someone elses BA?
• Will you have the clout to determine the contract
  form used?
• If you enter into different forms, how do you
  track the variations?
• BAs will probably perform a range of different
  activities and functions.
• How will you track what each one does?
• How will you track entry into and termination of
  BAC?
• How will you update and receive updated
  information from BAs, when necessary?
• What procedures do you need to respond in case a
  BA reports misuse of information?
• Will you be able to terminate for misuse of
  information? If not, what will you do?
• Will you permit the BA to retain information upon
  termination? If so, under what conditions?

6
Materials for Further Study

• Disclaimer Materials provided for educational
  purposes only. Nothing in this presentation or
  the materials provided constitutes legal advice.
  Contract documents should only be adopted based
  on review and discussion with informed legal
  counsel.

7
Thanks!

• John R. Christiansen
• Preston Gates Ellis LLP
• 701 Fifth Avenue
• Seattle, Washington 98104
• http//www.prestongates.com
• 206.613.7118
• Johnc_at_prestongates.com