Business Associates and Covered Entities Should Comply with HITECH Requirements Now

Business associates want to know. Covered entities want to know.

What do I do in order to comply with the new HIPAA laws in the Health Information for Economic and Clinical Health (HITECH) Act?

Actually, they have to know.

Compliance deadline is February 18, 2010, but many questions linger.

During a recent HCPro audio conference called Business Associates and Covered Entities: Adapt Contracts to Comply With New HIPAA Law, attendees asked plenty of questions:

• Which is the business associate when a medical device company sales representative is in the OR–the sales rep or the company?


• Can a covered entity, like a Medicare-certified hospice program, also be considered a business associate if it works on behalf of another covered entity?


• Will there be some guidance regarding whether updating the existing business associates is going to be required?

The questions probably won't stop any time soon. However, case-by-case scenarios aside, there is an overlying message to all parties affected by the new HIPAA laws.

"The first thing both the covered entities and the business associates should do is try to understand the new requirements, and analyze the gaps between their existing policies, procedures and practices, and what they should be doing–both under HITECH, and anything they’ve missed or avoided under HIPAA," said John R. Christiansen of Christiansen IT Law in Seattle, one of the speakers on the program.

Chris Apgar, president of Portland, OR-based Apgar & Associates, LLC,  also presented tips for compliance during the audio.

The next step is to map out your expectations regarding contract revisions. The last-minute approach will overwhelm each party.

"This could make for an unhappy holiday season and cancelled ski trips for folks in organizations which don’t start this process in the very near future," Christiansen said.