What Are Business Associates?
Fairfax County may require the assistance of various third parties in order to support the provision of health care services to our residents and employees.
This requires our designated business associates to provide assurances in meeting required safeguards for creating, receiving, storing and transmitting any electronic protected health information.
HIPAA mandates that an agreement be established between a covered entity (Fairfax County and its agencies) and any business associate that provides services on our behalf where individually identifiable health information may be encountered during the course of those services.
Business Associate Agreements
A signed Business Associate Agreement (BAA) with Fairfax County is required to ensure these parties will maintain the privacy and confidentiality of protected health information as well as provide necessary access to the information in accordance with the law.
- The business associate agreement is required independent of the monetary value of the contract. Business associate agreements may be required for anything from a small purchase order for a one-time shredding of old patient records to a multi-year contract for health information system software maintenance.
- Business associate agreements with Fairfax County are required regardless of the jurisdiction where the original contract was awarded.
Guidance for Completing Agreements
This guidance applies to completing either:
-
a Business Associate Agreement (BAA) or
-
a Business Associate/Qualified Service Organization Agreement (BA/QSOA)
- All BAAs or BA/QSOAs must be fully completed to be valid, with appropriate signatory.
- Questions regarding the completion of BAs or BA/QSOAs must be directed to the agency point of contact or the assigned contract specialist.
- Contact the Fairfax County HIPAA Compliance Officer regarding general HIPAA compliance requirements.