164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard)
Administrative safeguard · Standard
The requirement as we hold it
Business Associate Contracts and Other Arrangements (Standard). A covered entity may permit a business associate to handle ePHI only after obtaining satisfactory assurances via written contract. NIST recommends due diligence, security questionnaires, and ongoing monitoring of BAs.
The examiner asks
- Show me the written assurance you obtained before a business associate handled ePHI.
- Where is the due diligence that preceded the contract?
Evidence to bring
- the BAA
- the due-diligence record
Source: 164.308(b)(1) at eCFR. Our statement of the clause, not the instrument verbatim.