[Code of Federal Regulations]
[Title 45, Volume 1]
[Revised as of October 1, 2004]
From the U.S. Government Printing Office via GPO Access
[CITE: 45CFR164.314]

[Page 738-739]
 
                        TITLE 45--PUBLIC WELFARE
 
                    SUBTITLE A--DEPARTMENT OF HEALTH
                         AND HUMAN SERVICES
 
PART 164_SECURITY AND PRIVACY--Table of Contents
 
Subpart C_Security Standards for the Protection of Electronic Protected 
                           Health Information
 
Sec. 164.314  Organizational requirements.

    (a)(1) Standard: Business associate contracts or other arrangements.
    (i) The contract or other arrangement between the covered entity and 
its business associate required by Sec. 164.308(b) must meet the 
requirements of paragraph (a)(2)(i) or (a)(2)(ii) of this section, as 
applicable.
    (ii) A covered entity is not in compliance with the standards in 
Sec. 164.502(e) and paragraph (a) of this section if the covered entity 
knew of a pattern of an activity or practice of the business associate 
that constituted a material breach or violation of the business 
associate's obligation under the contract or other arrangement, unless 
the covered entity took reasonable steps to cure the breach or end the 
violation, as applicable, and, if such steps were unsuccessful--
    (A) Terminated the contract or arrangement, if feasible; or
    (B) If termination is not feasible, reported the problem to the 
Secretary.
    (2) Implementation specifications (Required).
    (i) Business associate contracts. The contract between a covered 
entity and a business associate must provide that the business associate 
will--
    (A) Implement administrative, physical, and technical safeguards 
that reasonably and appropriately protect the confidentiality, 
integrity, and availability of the electronic protected health 
information that it creates, receives, maintains, or transmits on behalf 
of the covered entity as required by this subpart;
    (B) Ensure that any agent, including a subcontractor, to whom it 
provides such information agrees to implement reasonable and appropriate 
safeguards to protect it;
    (C) Report to the covered entity any security incident of which it 
becomes aware;
    (D) Authorize termination of the contract by the covered entity, if 
the covered entity determines that the business associate has violated a 
material term of the contract.
    (ii) Other arrangements. (A) When a covered entity and its business 
associate are both governmental entities, the covered entity is in 
compliance with paragraph (a)(1) of this section, if--
    (1) It enters into a memorandum of understanding with the business 
associate that contains terms that accomplish the objectives of 
paragraph (a)(2)(i) of this section; or
    (2) Other law (including regulations adopted by the covered entity 
or its business associate) contains requirements applicable to the 
business associate that accomplish the objectives of paragraph (a)(2)(i) 
of this section.
    (B) If a business associate is required by law to perform a function 
or activity on behalf of a covered entity or to provide a service 
described in the definition of business associate as specified in Sec. 
160.103 of this subchapter to a covered entity, the covered entity may 
permit the business associate to create, receive, maintain, or transmit 
electronic protected health information on its behalf to the extent 
necessary to comply with the legal mandate without meeting the 
requirements of paragraph (a)(2)(i) of this section, provided that the 
covered entity attempts in good faith to obtain satisfactory assurances 
as required by paragraph (a)(2)(ii)(A) of this section, and documents 
the attempt and the reasons that these assurances cannot be obtained.
    (C) The covered entity may omit from its other arrangements 
authorization of the termination of the contract by the covered entity, 
as required by paragraph (a)(2)(i)(D) of this section if such 
authorization is inconsistent with the statutory obligations of the 
covered entity or its business associate.
    (b)(1) Standard: Requirements for group health plans. Except when 
the only electronic protected health information disclosed to a plan 
sponsor is disclosed pursuant to Sec. 164.504(f)(1)(ii) or (iii), or as 
authorized under Sec. 164.508, a group health plan must ensure that its 
plan documents provide that the plan sponsor will reasonably and 
appropriately safeguard electronic protected health information created, 
received, maintained, or transmitted to or by

[[Page 739]]

the plan sponsor on behalf of the group health plan.
    (2) Implementation specifications (Required). The plan documents of 
the group health plan must be amended to incorporate provisions to 
require the plan sponsor to--
    (i) Implement administrative, physical, and technical safeguards 
that reasonably and appropriately protect the confidentiality, 
integrity, and availability of the electronic protected health 
information that it creates, receives, maintains, or transmits on behalf 
of the group health plan;
    (ii) Ensure that the adequate separation required by Sec. 
164.504(f)(2)(iii) is supported by reasonable and appropriate security 
measures;
    (iii) Ensure that any agent, including a subcontractor, to whom it 
provides this information agrees to implement reasonable and appropriate 
security measures to protect the information; and
    (iv) Report to the group health plan any security incident of which 
it becomes aware.