If you haven’t developed that list in advance, this can create a “fire drill” environment. Especially in a large environment that has thousands of contracts, it can be a massive undertaking.

You should consider a BAA audit from the OCR as you would an IRS audit: having the information readily available will speed the process. Complicating the procedure is the fact that the initial e-mail notification from OCR can be filtered by some e-mail systems as “junk mail.” What do you do?


Being prepared well in advance for an audit is the key.
One of the first steps is to identify your organization’s business associates, and be certain you have a properly formulated and executed Business Associate Agreement with them. Contracts or agreements sitting in a remote office or someone’s file cabinet aren’t likely a part of your system if you aren’t aware of them. You can be out of compliance from the get-go.

You need to collect and catalogue these agreements, and have the list of associates with primary and secondary points of contact ready to report to OCR.

Building that list can be time-consuming and boring, but it will save sleepless nights and possible fines if you are audited. This is where using a single-contract life cycle management solution can play a critical role.

Where do I turn for help?
In most organizations, the compliance officer and/or chief legal counsel is the first line of information and preparation for an audit.

Of course, the HHS has a wealth of information on its website.

Finally, contract life cycle management solution providers like MediTract can be invaluable, supplying an on-line library or catalogue of contracts, as well as templates for Business Associate Agreements, attachments, and advice on who should be considered a Business Associate.

For more information on Business Associate Agreement audits, you can check out a recent webinar we conducted on the subject.

About the author: Diane Korbel is a client solutions advisor in professional services for MediTract Inc., one of the largest contract life cycle and compliance solutions providers. Diane specializes in business associate agreement audits and process improvement. Before joining MediTract she spent 17 years as the corporate insurance manager and risk management systems administrator for a major south Florida health system.

Back to HCB News

Risk Management Homepage