UA’s Contract Offices and Business Owners are responsible for:
- Determining if PHI is being shared with another entity, and if so;
- Determining whether:
- (a) UA is sharing its PHI (or the PHI UA holds on behalf of another Covered Entity in its capacity as a Business Associate) with a third party (company, sponsor, institution) and the third party is the Business Associate.
- (b) The third party (company, sponsor, institution) is sharing its PHI and UA is the Business Associate
Submit the Business Associate Intake Form to the UA HIPAA Privacy Office when a Business Associate Agreement is needed.