BAA agreements are not optional. The HITECH Act of 1996 put punitive measures into the HIPAA Act of 2009. One of the steps it took to protect a patients personal information, their PHI, was to create and require something called a Business Associate Agreement, a BAA.

Who Does This Apply To?

If you are in an industry providing health-related services directly to the end-client then you are obligated via the HITECH Act of 2009 to obtain one from anyone, in any industry, that you do business with. Period.

This applies to the janitor that cleans your offices. It applies to the psychologists, chirporactors, psychiatrists, web-developer and brain-surgeon that shares office space with you.

The end-game is to get ALL of your business associates to legally acknowledge that they will protect your clients' PHI in the event they should be exposed to it.

So, Where Do I Get a BAA Template?

Most healthcare businesses that have put their compliance policies and procedures in place, including your counseling practice, probably did so through a third-party company like SecurityMetrics. They specialize in compliance programs for the healthcare field.

When you implement your counselor-side Federal compliance program a custom BAA agreement is part of what you will receive. Please note that not all BAA agreements are identical which is why it's a really bad idea to beg your colleagues for a copy of theirs on Facebook. You want one that fits your practice legally and thoroughly covers your unique back-side, right?

BAA Agreements Are Not Optional

There's a couple of scenarios to consider here but in each case the solution is a simple one, and it's this: if the other guy won't sign your BAA then go find another guy!

If the other party is a non-healthcare product/services provider (your janitor, handy-man, office staff, anyone who works in your service-provider space) they will probably have never heard of a BAA. You'll need a gentle way to explain to them what it is you need from them and why before you ask them to sign a legal document. You'll want something that boils it all down to its' simplest form, like this:

"I am required by law to ask each of the people that work with
me to help me protect my clients' personal information. In order
for me to be able to work with you I need to ask you to promise
that anything you may see or hear about any client in our facility
will stay in our facility. That's exactly what this document says
and I am again required by law to ask you to sign one for me
so that we can work together. Will you do that for me, please?"

The other scenario is a head-shaker. If that other party that frequents your workspace is in the healthcare field he should already know what a BAA is and why he has to sign one. And he should be more than willing to do so!

Furthermore, since you two are sharing or frequenting each others' space and may be exposed to client information not your own, he's required by law to have you sign a copy of his BAA agreement as well!

If someone doesn't care enough about his own business to get compliant and protect himself from things that could destroy his practice overnight, do you really think he cares what happens to yours? Doesn't mean they're bad people, it's just a loud warning to steer clear of mixing your business with theirs.

The Bottom Line: Sign It!

Begin securing this document from those that frequent your work-space. There's too much at stake here to be dealing with people that don't understand and/or appreciate the potentially career-ending situation you face. Before you undertake a new business relationship with anyone, whether they're in the healthcare field or not, find out if they're willing to sign on the dotted line first. If not, move along...nothing to see here.

Plan Smart. Be Safe. Serve Others.

Kathleen Mills, LPC-S, CEAP