[Code of Federal Regulations]

[Title 45, Volume 1]

[Revised as of October 1, 2006]

From the U.S. Government Printing Office via GPO Access

[CITE: 45CFR164.314]



[Page 748-749]

 

                        TITLE 45--PUBLIC WELFARE

 

                    SUBTITLE A--DEPARTMENT OF HEALTH

                           AND HUMAN SERVICES

 

PART 164_SECURITY AND PRIVACY--Table of Contents

 

Subpart C_Security Standards for the Protection of Electronic Protected 

                           Health Information

 

Sec.  164.314  Organizational requirements.



    (a)(1) Standard: Business associate contracts or other arrangements. 

(i) The contract or other arrangement between the covered entity and its 

business associate required by Sec.  164.308(b) must meet the 

requirements of paragraph (a)(2)(i) or (a)(2)(ii) of this section, as 

applicable.

    (ii) A covered entity is not in compliance with the standards in 

Sec.  164.502(e) and paragraph (a) of this section if the covered entity 

knew of a pattern of an activity or practice of the business associate 

that constituted a material breach or violation of the business 

associate's obligation under the contract or other arrangement, unless 

the covered entity took reasonable steps to cure the breach or end the 

violation, as applicable, and, if such steps were unsuccessful--

    (A) Terminated the contract or arrangement, if feasible; or

    (B) If termination is not feasible, reported the problem to the 

Secretary.

    (2) Implementation specifications (Required).

    (i) Business associate contracts. The contract between a covered 

entity and a business associate must provide that the business associate 

will--

    (A) Implement administrative, physical, and technical safeguards 

that reasonably and appropriately protect the confidentiality, 

integrity, and availability of the electronic protected health 

information that it creates, receives, maintains, or transmits on behalf 

of the covered entity as required by this subpart;

    (B) Ensure that any agent, including a subcontractor, to whom it 

provides such information agrees to implement reasonable and appropriate 

safeguards to protect it;

    (C) Report to the covered entity any security incident of which it 

becomes aware;

    (D) Authorize termination of the contract by the covered entity, if 

the covered entity determines that the business associate has violated a 

material term of the contract.

    (ii) Other arrangements. (A) When a covered entity and its business 

associate are both governmental entities, the covered entity is in 

compliance with paragraph (a)(1) of this section, if--

    (1) It enters into a memorandum of understanding with the business 

associate that contains terms that accomplish the objectives of 

paragraph (a)(2)(i) of this section; or



[[Page 749]]



    (2) Other law (including regulations adopted by the covered entity 

or its business associate) contains requirements applicable to the 

business associate that accomplish the objectives of paragraph (a)(2)(i) 

of this section.

    (B) If a business associate is required by law to perform a function 

or activity on behalf of a covered entity or to provide a service 

described in the definition of business associate as specified in Sec.  

160.103 of this subchapter to a covered entity, the covered entity may 

permit the business associate to create, receive, maintain, or transmit 

electronic protected health information on its behalf to the extent 

necessary to comply with the legal mandate without meeting the 

requirements of paragraph (a)(2)(i) of this section, provided that the 

covered entity attempts in good faith to obtain satisfactory assurances 

as required by paragraph (a)(2)(ii)(A) of this section, and documents 

the attempt and the reasons that these assurances cannot be obtained.

    (C) The covered entity may omit from its other arrangements 

authorization of the termination of the contract by the covered entity, 

as required by paragraph (a)(2)(i)(D) of this section if such 

authorization is inconsistent with the statutory obligations of the 

covered entity or its business associate.

    (b)(1) Standard: Requirements for group health plans. Except when 

the only electronic protected health information disclosed to a plan 

sponsor is disclosed pursuant to Sec.  164.504(f)(1)(ii) or (iii), or as 

authorized under Sec.  164.508, a group health plan must ensure that its 

plan documents provide that the plan sponsor will reasonably and 

appropriately safeguard electronic protected health information created, 

received, maintained, or transmitted to or by the plan sponsor on behalf 

of the group health plan.

    (2) Implementation specifications (Required). The plan documents of 

the group health plan must be amended to incorporate provisions to 

require the plan sponsor to--

    (i) Implement administrative, physical, and technical safeguards 

that reasonably and appropriately protect the confidentiality, 

integrity, and availability of the electronic protected health 

information that it creates, receives, maintains, or transmits on behalf 

of the group health plan;

    (ii) Ensure that the adequate separation required by Sec.  

164.504(f)(2)(iii) is supported by reasonable and appropriate security 

measures;

    (iii) Ensure that any agent, including a subcontractor, to whom it 

provides this information agrees to implement reasonable and appropriate 

security measures to protect the information; and

    (iv) Report to the group health plan any security incident of which 

it becomes aware.