Business Associate Agreements are required by the regulation whenever a business associate
relationship exists. This is true even when the business associates are both covered entities.
A.
There are no specific elements which must be included in a Business Associate Agreement.
However some recommended but not compulsory elements are listed in 164.504(e) (2)
B.
There are specific elements which must be included in a Business Associate Agreement. These
elements are listed Privacy Legislation
C.
There are no specific elements which must be included in a Business Associate Agreement.
D.
There are specific elements which must be included in a Business Associate Agreement. These
elements are listed in 164.504(e) (2)
Explanation:
Business Associate Contracts. A covered entity’s contract or other written arrangement with its
business associate must contain the elements specified at 45 CFR 164.504(e). For example, the
contract must: Describe the permitted and required uses of protected health information by the
business associate; Provide that the business associate will not use or further disclose the protected
health information other than as permitted or required by the contract or as required by law; and
Require the business associate to use appropriate safeguards to prevent a use or disclosure of the
protected health information other than as provided for by the contract. Reference:
http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/businessassociates.html