All covered entities and business associates will need to review their business associate agreements in light of the new final HIPAA regulations (see prior coverage here). The new rules are effective March 26, 2013, with a general compliance deadline of September 23, 2013. So what is the deadline for reviewing and updating a business associate agreement?
Transition Rule. Under a transition rule in the new regulations, covered entities and business associates (and business associates and their subcontractors) may continue to operate under certain existing agreements for up to one year beyond the general compliance date of September 23, 2013.
There are two conditions for this rule:
(1) Already in existence. A written business associate agreement must have been in existence on January 25, 2013 (the date the new final rule was released) and must satisfy the requirements of the prior HIPAA rule.
(2) Not renewed or modified. The business associate agreement must not be renewed or modified between March 26, 2013 and September 23, 2013.
If these conditions are satisfied, the agreement will be deemed to satisfy the new rules until the earlier of (i) the date the agreement is renewed or modified on or after September 23, 2013, or (ii) September 22, 2014. In other words, if these conditions are met, covered entities and business associates will have until as late as September 22, 2014 to update their agreements to comply with the final rule.
Evergreen Agreements. This transition rule is available for agreements that automatically renew between March 26, 2013 and September 23, 2013 under “evergreen” renewal provisions, so long as there is no change in the contract terms and no other action taken by the parties in connection with the renewal.
Should the Transition Rule Be Relied On? Although this transition rule may be helpful in some cases, covered entities and business associates must be absolutely certain that all the conditions for reliance on the rule are satisfied. For example, the parties must be certain the existing agreement complies with prior law.
Failure to timely amend a business associate agreement could lead to substantial penalty exposure. Given this risk, it is recommended that covered entities and business associates make every effort to meet the general compliance deadline of September 23, 2013 and rely on this transition rule only when necessary and once they have made certain it applies.