1. Ophthalmic Associates of Fort Washington
Business Associate Policy and Procedure
Reference: Administrative safeguards standards section 164.308(b)(1)—Business
Associate Contract and other Arrangements
Issued: 01/01/2014
Effective Date: 01/01/2014
Policy Number: 10
Approved by: Tara Kresge
_____________________________________________________________________________
_
Policy
Ophthalmic Associates of Fort Washington will establish Business Associate Agreements to
ensure that organizations that 1) create, maintain, receive, or transmit electronic protected health
information (ePHI) for Ophthalmic Associates of Fort Washington or 2) provide legal, actuarial,
consulting, data aggregation, management, administrative, accreditation, or financial services for
Ophthalmic Associates of Fort Washington will appropriately safeguard this information.
Ophthalmic Associates of Fort Washington will update the Business Associate Agreements
implemented in accordance with the Privacy Rule to incorporate the requirements of the Security
Rule.
Procedures
Written Contract or Other Arrangement
The security officer will determine all organizations that are considered business associates.
Agreements with all business associates will be documented via a written contract. All business
associates will be required to implement “reasonable and appropriate” safeguards to protect ePHI
and to notify the practice if they become aware of a “security incident.” Business associates will
also be required to enter into similar agreements with subcontractors to whom they delegate a
function, activity, or service they have agreed to perform for Ophthalmic Associates of Fort
Washington that involves the creation, receipt, maintenance, or transmission of protected health
information.
Examples of business associates include:
• Billing companies
• Software vendors
• Transcription services
• Medical record storage companies
• Answering services
• Accountants
• Consultants
• Health information organizations

2. • ePrescribing gateways
• Personal health record companies
© Pennsylvania Medical Society, 2013. Reproduction and use of this example policy by physician practices that
purchase the HIPAA Security Toolkit is permitted, but it should be customized for your use. Any other use,
duplication, or distribution of this example policy by any other party requires the prior written approval of PAMED.