Contracts

Question 1

When do you need a DPA?

Answer 1

Whenever a data processor carries out any processing on your behalf, you need to have a written contract in place.

This means that you need a DPA, for example, when you use customer relationship management platforms (CRMs), customer data platforms (CDPs), analytics and many other types of tools designed to analyze user behavior.

Question 2

According to the UK Information Commissioner’s Office:

Contracts between controllers and processors ensure that they both understand their obligations, responsibilities and liabilities. They help them to comply with the GDPR, and help controllers to demonstrate their compliance with the GDPR. The use of contracts by controllers and processors may also increase data subjects’ confidence in the handling of their personal data.

Answer 2

The contract is important so that both parties understand their role in handling users’ personal data and their obligations arising from it. It ensures that the chain of responsibility is clear to each participant in the process.

This isn’t anything new. Signing this kind of document is required by many other data privacy regulations, including the British Data Protection Act and GDPR’s predecessor, the Data Protection Directive 95/46/EC.

That said, under GDPR the contract requirements are broader. They also help to demonstrate compliance of each party in case of an audit by data protection authorities.

Question 3

GDPR imposes many obligations on those who want to collect and use personal data about users. One of the most important is DPAs with every party that has access to this data. A DPA or commissioned data processing clause is a legally binding document signed between the controller and the processor. It regulates the particularities of data processing, such as:

Answer 3

The scope and purpose of the processing
The relationship between these actors
The obligations of each party under the regulation

Question 4

Does a DPA have to be a separate document?

Answer 4

There’s no legal restriction stipulating that a DPA can’t be a part of a regular contract between the processor and the controller. However, considering the complexity of the task, it’s good to create a separate document or annex to the main contract.

Question 5

What should be included in a DPA?

Answer 5

GDPR gives some general guidance on what to include in a DPA. Based on the regulation, as well as our own experience and expertise, we’ve prepared a list of elements every data processing agreement should have.

1) General clauses

In this part of the contract you specify the terms used in the document. Among other things, you should define:

The subject of the agreement – typically that would be all activities related to the contractual relationship between partners.
The scope, nature and duration of data processing – how personal data will be used and which party will be responsible for compliance of the process. This liability typically rests with the data controller (you).
The subjects of data processing – whose data you want to process, e.g. children, banking clients, patients or simply website visitors. Data subjects can fall into more than one category.
Type of data you want to process – different categories of data you want to process. This could be e.g. technical characteristics of the browser, behavioral data on website activities or IP addresses.
Data storage – Although GDPR doesn’t forbid companies from storing users’ personal data outside the EU, it sets restrictions for these transfers (see: Chapter 5). The processor shouldn’t send data offshore without prior consent. If data is to be kept abroad, you need to describe how the data processor should handle it to match the protection standards set by GDPR. As the instructions should be detailed, it’s worth including them in a separate clause or even an annex to the contract.
Conditions of contract termination – Here you should state that all data about your users has to be removed from the processor’s databases after the termination of the contract. You should also detail when you have the right to terminate the agreement – for instance, if the processor fails to inform you about a data breach or makes unauthorized changes to data processing procedures.

Question 6

A DPA shouldn’t leave any room for misinterpretation. To avoid gray areas, remember to:

Answer 6

1) Set the time frames in which the data processor must process data requests and within which the data processor has to inform you about a data breach
2) Disclose contact details of your data protection officer
3) Specify if and how often you plan to carry out audits on the processor and who will cover the expenses involved

That way you make sure that there are no weak links and the data processor knows exactly what you expect of them.

Question 7

The provisions of this part of the contract should be

Answer 7

adapted to the specific needs of the organization and industry-relevant requirements.

Question 8

Business Associate’s Agreement (BAA)

Question 9

What is required to be in a baa?

Answer 9

The satisfactory assurances must be in writing, whether in the form of a contract or other agreement between the covered entity and the business associate. Appropriate safeguards need to be established, ensuring that the business associate will prevent PHI disclosure outside of what is permitted in the contract.

Question 10

What is a required document between a covered entity and a business associate?

Answer 10

A written contract between a covered entity and a business associate must: (1) establish the permitted and required uses and disclosures of protected health information by the business associate; (2) provide that the business associate will not use or further disclose the information other than as permitted or required ..

Question 11

Do Employees Have to Sign a BAA?

Answer 11

Direct employees don’t have to sign a BAA. That’s because people who work for you are part of your organization and aren’t considered as business associates. That said, they still fall under HIPAA laws.

Question 12

Who is not considered a business associate under HIPAA?

Answer 12

A member of the covered entity’s workforce is not a business associate. A covered health care provider, health plan, or health care clearinghouse can be a business associate of another covered entity.

Question 13

Is a BAA required between two covered entities?

Answer 13

Yes. If you hire another HIPAA-covered organization to create, maintain, receive, or transmit PHI on your organization’s behalf, then they are your business associate.

Question 14

The HITECH Act and Omnibus Rule, business associates1 of covered entities must comply with most of the HIPAA Privacy and Security Rules applicable to covered entities or face penalties

Answer 14

of $100 to $50,000 per violation.

Question 15

Among other things, covered entities and business associates must execute agreements whereby the business associate agrees to comply with certain Privacy and Security Rule provisions affecting protected health information (“PHI”). The Omnibus Rules requires most covered entities and business associates to review and update their business associate agreements (“BAAs”) by September 23, 2013.

Answer 15

The Omnibus Rules will also require covered entities to execute BAAs with certain entities that were not considered business associates in the past, including data storage companies and entities that provide data transmission services and require access to the data on a routine basis.

Question 16

Under the HIPAA Privacy and Security Rules, BAAs generally must contain the following terms. To the extent the business associate enters a BAA with its subcontractors, those subcontract BAAs should also contain equivalent terms.

Answer 16

1. Establish the permitted and required uses and disclosures of PHI by the business associate.

The BAA may not authorize the business associate to use or further disclose the PHI in a manner that would violate the Privacy Rule if done by the covered entity, except that the BAA may but is not required to:

Permit the business associate to use and disclose PHI for the proper management and administration of the business associate.

Permit the business associate to provide data aggregation services relating to the health care operations of the covered entity.

Permit the business associate to disclose PHI for the foregoing purposes if (1) the disclosure is required by law, or (2)(i) the business associate obtains reasonable assurances from the person to whom the PHI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and (ii) the person notifies the business associate of any instances of which it is aware in which the confidentiality of the PHI has been breached.

Question 17

2. Provide that the business associate will:

Answer 17

Not use or further disclose the PHI other than as permitted or required by the BAA or as required by law.
Use appropriate safeguards to prevent use or disclosure of the PHI other than as provided for by the BAA.
Where applicable, comply with Security Rules with respect to electronic PHI.
Report to the covered entity any security incidents or use or disclosure of PHI not provided for by the BAA of which it becomes aware, including breaches of unsecured PHI as required by § 164.410.
Ensure that any subcontractors that receive, maintain or transmit PHI on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such PHI. Business associates may do so by requiring the subcontractors to execute a BAA with the business associate.
Make available PHI consistent with the patient’s right to access PHI as set forth in § 164.524.
Make available PHI for amendment and incorporate any amendments to PHI in accordance with
§ 164.526.
Make available the information required to provide an accounting of disclosures in accordance with
§ 164.528, including certain information concerning disclosures of PHI in violation of the Privacy Rule.
To the extent the business associate is to carry out a covered entity’s obligation under the Privacy Rule, comply with the requirements of the Privacy Rule that apply to the covered entity in the performance of such obligation. [Note: this is a new requirement under the Omnibus Rule].
Make its internal practices, books and records relating to the use and disclosure of PHI received from, or created or received by the business associate on behalf of, the covered entity available to the Secretary of HHS for purposes of determining the covered entity’s compliance with the Privacy Rule.

Question 18

3. Include appropriate termination provisions, i.e.:

Answer 18

a. At termination of the contract, if feasible, the business associate must return or destroy all PHI received from, or created or received by the business associate on behalf of, the covered entity that the business associate still maintains in any form and retain no copies of such PHI.
b. If such return or destruction of PHI is not feasible, extend the protections of the BAA to the PHI and limit further uses and disclosures to those purposes that make the return or destruction of the PHI infeasible.
c. Authorize termination of the BAA by the covered entity if the covered entity determines that the business associate has violated a material term of the BAA.

Question 19

Additional Terms.

Answer 19

The OCR has published sample BAA language at its website, http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/contractprov.html. However, the OCR’s sample language may not include additional terms that covered entities and business associates may want to include in their agreements.

Question 20

While not required by HIPAA, covered entities may want to:

Answer 20

a. Confirm that the business associate is acting as an independent contractor and not as the agent of the covered entity.
b. Require business associates and subcontractors to carry appropriate insurance to cover HIPAA violations.
c. Require business associates and subcontractors to defend and indemnify the covered entity for violations of HIPAA or the BAA.
d. Require business associates, at their own cost, to respond to any potential HIPAA violation and provide any notice of privacy breaches or security incidents as mandated by the Privacy, Security or Breach Notification Rules.
e. Impose time limits or other conditions on the business associate’s performance so long as such conditions do not establish an agency relationship as discussed below.
f. Coordinate the BAA with the underlying services agreement.
g. Include additional term or termination provisions.
h. Authorize termination of the underlying services agreement if the BAA is terminated.
i. Allow for amendment of the BAA as necessary to accommodate changes to the HIPAA Rules.
Include choice of law and venue provisions.

Question 21

Business associates may want to include additional or alternative terms that minimize their exposure, such as:

Answer 21

a. Prohibit covered entities from asking the business associate to take any action that would violate the HIPAA Rules if done by the covered entity.
b. Prohibit covered entities from agreeing to restrictions on the use or disclosure of PHI that might adversely affect the business associate, or notify the business associate of such restrictions.
c. Authorize termination of the BAA if the covered entity agrees to restrictions that materially affect the business associate’s ability to perform or costs of performance.
d. Allow the business associate to recover costs associated with such additional restrictions or requirements.
e. Eliminate or limit any insurance or indemnification agreement otherwise requested by the covered entity.
f. Waive or limit damages for which the business associate may be liable under the BAA.

Question 22

Liability for Business Associate’s Action.

Answer 22

The HIPAA Privacy and Security rules confirm that a covered entity violates HIPAA if the covered entity knew of a pattern of activity or practice of a business associate that constituted a material breach or violation of the BAA unless the covered entity took reasonable steps to cure the breach, end the violation, or terminate the contract.11 In addition, a covered entity may be vicariously liable for the business associate’s misconduct if the business associate was acting as the agent of the covered entity.12 The same rules apply to a business associates with respect to their subcontractors.13 Accordingly, covered entities and business associates should ensure that their BAAs:

Confirm the business associate or subcontractor is acting as an independent contractor, and not as the agent of the covered entity or business associate; and
Confirm that the BAA does not give the covered entity or business associate such control over operational activities so as to make the business associate the agent of the covered entity, or the subcontractor the agent of the business associate.

Question 23

Effect of No BAA.

Answer 23

Covered entities and business associates violate HIPAA if there is no required BAA in place; however, business associates must still comply with the relevant HIPAA Rules even if there is no BAA.

Question 24

Which Additional Business Associate Agreement Provisions Commonly Are Requested and Negotiated?

Answer 24

Breach cost, indemnification, and cyber liability insurance coverage are examples of additional provisions that are commonly requested and negotiated. Whether there are breach cost, indemnification, or cyber liability insurance coverage provisions in any related agreement is one issue to consider.

Breach Cost. Issues to take into account regarding breach cost provisions include how a breach is defined, whether the breach is under the Health Insurance Portability and Accountability Act and Health Information Technology for Economic and Clinical Health Act only or also under the state breach notification laws, who caused the breach, specified breach costs, and any limits.

Indemnification. Issues to consider regarding indemnification provisions include whether the indemnification provision is mutual, who is indemnified, which events trigger indemnification, specified costs, and any limits.

Cyber Liability Insurance Coverage. Issues regarding cyber liability insurance coverage provisions include whether a party has and will have cyber liability insurance coverage (a related issue is how much it costs and will cost the party), the scope and nature of the coverage, particular amounts of coverage, the time period for coverage, and changes in coverage.

Question 25

45 CFR 160.103

Answer 25

regarding business associates, protected health information, and subcontractors.

Question 26

The CCPA requires that a service provider agree to three substantive restrictions involving

Answer 26

the retention, use, and disclosure of personal information.

Question 27

The CPRA ostensibly expands upon the three substantive contractual restrictions by referring to

Answer 27

nine additional provisions that should be included within a service provider agreement.