164.314(a)(2)(i) Business Associate Contract Required Provisions
Organizational safeguard · Provision
The requirement as we hold it
Business Associate Contract Required Provisions. The contract between a covered entity and a business associate must provide that the business associate will comply with the applicable Security Rule requirements, ensure subcontractors comply, report security incidents including breaches, and authorize termination by the covered entity if the business associate violates a material term.
The examiner asks
- Show me the contract clause that binds the business associate to the Security Rule.
- Where does it require breach reporting and a right to terminate on a material breach?
Evidence to bring
- the required-provisions clause
- the termination-right clause
Source: 164.314(a)(2)(i) at eCFR. Our statement of the clause, not the instrument verbatim.