Who is responsible for ensuring that BAAs are in place?

UA’s Contract Offices and Business Owners are responsible for:

1. Determining if PHI is being shared with another entity, and if so;
2. Determining whether:
   1. (a) UA is sharing its PHI (or the PHI UA holds on behalf of another Covered Entity in its capacity as a Business Associate) with a third party (company, sponsor, institution) and the third party is the Business Associate.
   2. (b) The third party (company, sponsor, institution) is sharing its PHI and UA is the Business Associate

Submit the Business Associate Intake Form to the UA HIPAA Privacy Office when a Business Associate Agreement is needed.