Privacy Officer?

[Chaz]

Are business associates specifically required under the final HITECH regulations to appoint a privacy officer? If so, can someone provide the applicable regulation, as I can't seem to find one. Thanks!

[GBurns]

If you look at the Sample Business Associates Agreements on the HHS website you will see that the Agreement must state that the BA is required to implement safeguards including the HIPAA Security Rules. The Security rules require a security official. See 45 CFR 164.308(a)(2).There are Summaries on the upper left.

[Chaz]

If you look at the Sample Business Associates Agreements on the HHS website you will see that the Agreement must state that the BA is required to implement safeguards including the HIPAA Security Rules. The Security rules require a security official. See 45 CFR 164.308(a)(2).There are Summaries on the upper left.

Does that requirement also extend to appointing a Privacy Officer as well?

[GBurns]

The Summary does say:

"Privacy Personnel. A covered entity must designate a privacy official responsible for developing and implementing its privacy policies and procedures, and a contact person or contact office responsible for receiving complaints and providing individuals with information on the covered entity’s privacy practices."

I guess that the Security Officer could also be 1 of the 2 privacy personnel positions which, as I was advised, could be held by 1 person In other words 1 person 3 functions.You might want to read the actual wording of the statute at 45 CFR 164.530(a)..

[Chaz]

I think I found my answer in the preamble to the final rule (see emphasis added):

Some commenters requested clarification as
to which provisions of the Privacy Rule apply
directly to business associates, and one
commenter recommended applying all
of the provisions of the Privacy Rule to
business associates, including requiring
business associates to implement
reasonable safeguards, train employees,
and designate a privacy official.

. . . .

As we discuss further below, section
13404 of the HITECH Act creates direct
liability for impermissible uses and
disclosures of protected health
information by a business associate of a
covered entity ‘‘that obtains or creates’’
protected health information ‘‘pursuant
to a written contract or other
arrangement described in
§ 164.502(e)(2)’’ and for compliance
with the other privacy provisions in the
HITECH Act. Section 13404 does not
create direct liability for business
associates with regard to compliance
with all requirements under the Privacy
Rule (i.e., does not treat them as covered
entities). Therefore, under the final rule,
a business associate is directly liable
under the Privacy Rule for uses and
disclosures of protected health
information that are not in accord with
its business associate agreement or the
Privacy Rule. In addition, a business
associate is directly liable for failing to
disclose protected health information
when required by the Secretary to do so
for the Secretary to investigate and
determine the business associate’s
compliance with the HIPAA Rules, and
for failing to disclose protected health
information to the covered entity,
individual, or individual’s designee, as
necessary to satisfy a covered entity’s
obligations with respect to an
individual’s request for an electronic
copy of protected health information.
See § 164.502(a)(3) and (a)(4). Further, a
business associate is directly liable for
failing to make reasonable efforts to
limit protected health information to the
minimum necessary to accomplish the
intended purpose of the use, disclosure,
or request. See § 164.502(b). Finally,
business associates are directly liable for
failing to enter into business associate
agreements with subcontractors that
create or receive protected health
information on their behalf. See
§ 164.502(e)(1)(ii). As was the case
under the Privacy Rule before the
HITECH Act, business associates remain
contractually liable for all other Privacy
Rule obligations that are included in

their contracts or other arrangements
with covered entities.

[GBurns]

So what is your conclusion?

[Chaz]

That BAs do not need to comply with the full panoply of the Privacy Rule's requirements, including appointing a privacy official. They only need to comply with the items specified starting with the sentence that begins "Therefore" above.

Thoughts?