Business Associate Agreement Requirements for Pharmacy Benefit Administrators

When does a pharmacy benefit administrator need a business associate agreement?

A pharmacy benefit administrator (PBA) generally needs a business associate agreement (BAA) when it performs services on behalf of a HIPAA-covered health plan or another business associate and those services involve protected health information (PHI). Examples may include processing or administering claims, managing benefits, analyzing data, or administering a health plan’s pharmacy network. HHS specifically identifies a pharmacy benefits manager that manages a health plan’s pharmacist network as a business associate. HHS Business Associates FAQs

The name of the service or contract does not decide the issue. Assess who the PBA serves, what functions it performs, and whether it creates, receives, maintains, or transmits PHI on behalf of a covered entity or another business associate. If the PBA is acting on its own behalf as a covered entity, or its service does not involve PHI, a BAA may not be required for that relationship. HHS Covered Entities and Business Associates

What permitted uses and disclosures of PHI should the agreement specify?

Describe the PBA’s services and the permitted and required uses and disclosures of PHI needed to perform them. Depending on the arrangement, the agreement might cover pharmacy claims processing, benefit administration, eligibility support, utilization review, or agreed reporting. The PBA may use or disclose PHI only as the BAA permits or requires, or as required by law; it may not use PHI in a way that would violate the Privacy Rule if the covered entity did so, subject to limited exceptions. HHS Sample Business Associate Agreement Provisions

Specify any agreed uses for the PBA’s proper management and administration or for data aggregation related to the covered entity’s health care operations. The agreement should also limit requests for, and uses or disclosures of, PHI to what is reasonably necessary for the intended purpose, consistent with applicable minimum necessary rules. HHS Minimum Necessary Guidance

Which HIPAA privacy and security safeguards must be included?

The BAA must require appropriate safeguards against uses or disclosures of PHI that the agreement does not permit. If the PBA creates, receives, maintains, or transmits electronic protected health information (ePHI), the agreement must require it to comply with applicable HIPAA Security Rule requirements. The Security Rule calls for administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI. HHS Security Rule Overview

In practice, the parties can use the BAA to define security responsibilities, such as access controls, workforce procedures, risk management, incident response, and protection of systems and devices that handle ePHI. Encryption is an addressable Security Rule implementation specification, not an across-the-board standalone requirement in every situation; the regulated entity must assess whether it is reasonable and appropriate and document its decision. HHS Encryption FAQ

How should breaches and other incidents be reported?

Require the PBA to report impermissible uses or disclosures of PHI, security incidents, and breaches of unsecured PHI. For a breach of unsecured PHI, HIPAA requires a business associate to notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. That is the outside federal deadline, not a recommended reporting target for every contract; the parties can set a shorter deadline so the covered entity has time to investigate and meet its own duties. HHS Breach Notification Rule

Spell out how the PBA must send notice and what information it must provide, including the affected individuals’ identities when possible and other available details needed for required notifications. The agreement can also require prompt preliminary notice followed by updates as the investigation develops. 45 CFR Part 164, including § 164.410

How must the administrator support individual rights requests?

The BAA should require the PBA to make PHI in a designated record set available to the covered entity as needed to respond to access requests, and to make or incorporate amendments as directed by the covered entity. It should also require the PBA to provide information about relevant disclosures so the covered entity can respond to an accounting of disclosures request. HHS Guidance on Business Associates and Individual Rights

The covered entity remains responsible for fulfilling these Privacy Rule duties, but the parties may agree that the PBA will handle particular tasks or respond directly to individuals where appropriate. Include procedures for routing requests, identifying the records involved, and supplying the covered entity with complete and timely information. HHS Sample Business Associate Agreement Provisions

What subcontractor and oversight provisions are required?

If the PBA uses a subcontractor that will create, receive, maintain, or transmit PHI on its behalf, the PBA must obtain a written agreement requiring the subcontractor to comply with the applicable restrictions and conditions that apply to the PBA. For subcontractors handling ePHI, the Security Rule also requires applicable Security Rule obligations to flow down through the agreement. HHS Business Associates FAQs

The BAA must provide for access to relevant internal practices, books, and records by HHS for purposes of determining compliance. It should also describe practical cooperation and escalation procedures. If the covered entity learns of a material breach or violation, HIPAA requires reasonable steps to cure it or end the violation and, if those steps fail and termination is feasible, termination of the agreement. 45 CFR Part 164, including § 164.504

What happens to PHI when the agreement ends?

At termination, the BAA must require the PBA, if feasible, to return or destroy PHI received from or created or received on behalf of the covered entity. The requirement also applies to PHI held by subcontractors. The agreement should explain the return or destruction process, how completion will be confirmed, and how copies will be addressed. HHS Sample Business Associate Agreement Provisions

If return or destruction is infeasible, the PBA must continue protecting the PHI and limit further uses and disclosures to the purposes that make return or destruction infeasible. Specify how the parties will document that limitation and handle the information for as long as it remains in the PBA’s possession.

In short, a well-drafted BAA connects the PBA’s specific services to clear limits on PHI use, safeguards, reporting, individual-rights support, subcontractor obligations, and PHI return or destruction.

FAQs

Does a pharmacy benefit administrator always need a business associate agreement?

No. A BAA is generally needed when the administrator performs services on behalf of a covered entity or business associate involving PHI. The answer depends on the administrator’s role and the services involved, not its title. HHS Business Associates FAQs

What must the agreement require when PHI is breached?

It must require the business associate to notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. The agreement should specify the operational reporting deadline and require details needed for the covered entity’s investigation and notifications. HHS Breach Notification Rule

Must subcontractors sign agreements covering PHI?

Yes, when a subcontractor will create, receive, maintain, or transmit PHI on behalf of the business associate. The written agreement must impose the applicable restrictions and conditions on the subcontractor, including Security Rule requirements when it handles ePHI. HHS Business Associates FAQs

What should happen to PHI when the agreement terminates?

If feasible, the business associate should return or destroy the PHI, including relevant copies held by subcontractors. If that is infeasible, the agreement must require continued protections and restrict further uses and disclosures to the purposes that make return or destruction infeasible. HHS Sample Business Associate Agreement Provisions