Compliance and risk
Business associate agreement
A business associate agreement is a written contract with a vendor that handles patient health information for the practice, setting rules for how the vendor protects it.
Under HIPAA, a vendor that creates, receives, maintains or sends protected health information for a practice is a business associate. Examples can include a billing service, an IT provider or a cloud software company.
HHS says a written contract between a covered entity and a business associate must establish the permitted and required uses and disclosures of protected health information by the business associate. The contract must also require safeguards and reporting to the practice of any improper use or disclosure.
A dental practice should have this contract in place before sharing data. See HIPAA and the HIPAA Security Rule. An attorney can review the terms.