Existing Language, Final Rule, 12/28/2000

§ 164.502 Uses and disclosures of protected health information: general rules.

[No changes to §164.502(e), Standard: disclosures to business associates.]

§ 164.502 Uses and disclosures of protected health information: general rules.

[No changes to §164.502(e), Standard: disclosures to business associates.]

§ 164.504 Uses and disclosures: Organizational requirements.

[No changes to §164.504(e), Standard: business associate contracts.]

§ 164.504 Uses and disclosures: Organizational requirements.

[No changes to §164.504(e), Standard: business associate contracts.]

§ 164.532 Transition provisions.

§ 164.532 Transition provisions.

(d) Standard: Effect of prior contracts or other arrangements with business associates.

Notwithstanding any other provisions of this subpart, a covered entity, other than a small health plan, may disclose protected health information to a business associate and may allow a business associate to create, receive, or use protected health information on its behalf pursuant to a written contract or other written arrangement with such business associate that does not comply with §§164.502(e) and 164.504(e) consistent with the requirements, and only for such time, set forth in paragraph (e) of this section.

(e) Implementation specification: Deemed compliance. ‑ 

(1) Qualification. Notwithstanding other sections of this subpart, a covered entity, other than a small health plan, is deemed to be in compliance with the documentation and contract requirements of §§164.502(e) and 164.504(e), with respect to a particular business associate relationship, for the time period set forth in paragraph (e)(2) of this section, if:

(i) Prior to the effective date of this provision, such covered entity has entered into and is operating pursuant to a written contract or other written arrangement with a business associate for such business associate to perform functions or activities or provide services that make the entity a business associate; and

(ii) The contract or other arrangement is not renewed or modified from the effective date of this provision and until the compliance date set forth in §164.534.

(2) Limited deemed compliance period. A prior contract or other arrangement that meets the qualification requirements in paragraph (e) of this section, shall be deemed compliant until the earlier of:

(i) The date such contract or other arrangement is renewed or modified on or after the compliance date set forth in § 164.534; or

(ii) April 14, 2004.

(3) Covered entity responsibilities. Nothing in this section shall alter the requirements of a covered entity to comply with part 160, subpart C, of this subchapter and §§164.524, 164.526, 164,528 with respect to protected health information held by a business associate.

[New provisions.]