[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-282264-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-282264-en":127},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","mdhhs-business-associate-agreement-policyprocedure","MDHHS Business Associate Agreement Policy/Procedure","","This policy establishes privacy protections required by the Michigan Department of Health and Human Services (MDHHS) when disclosing, using, or further disclosing Protected Health Information (PHI) by business associates on MDHHS’s behalf. It defines key terms such as Business Associate, Business Associate Agreement, Covered Entity, EPHI, and Workforce, and sets requirements for executing a legally binding BAA aligned with HIPAA Privacy and Security Rules. It also details roles for compliance, documentation, exception handling, and incident breach reporting.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/letters/","Letters",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/mdhhs-business-associate-agreement-policyprocedure/282264/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/mdhhs-business-associate-agreement-policyprocedure/282264.png","ImageObject",442,249,{"name":42,"@type":43},"Quinn","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-20","2026-09-16",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",13,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"When does MDHHS require a Business Associate Agreement (BAA)?","Question",{"text":63,"@type":64},"A BAA is required when a HIPAA-covered MDHHS component establishes a business partnership with an outside person or organization that will need to share Protected Health Information (PHI).","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"What information must a party provide before submitting a request for a BAA?",{"text":68,"@type":64},"The party must provide the business associate name and a description of how the business associate will use and/or disclose PHI and what protections will be in place.",{"name":70,"@type":61,"acceptedAnswer":71},"What should a business associate do if there is a suspected or confirmed data breach involving MDHHS data?",{"text":72,"@type":64},"The business associate must contact CDGB by completing the incident report form (DHHS-1422), after which CDGB evaluates breach scope, reviews mitigation efforts, and approves resolution.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},282264,1790183351,{"code":4,"msg":82,"data":83},"success",[84,89,94,99,104,109,114,118,123],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":86,"show_sort_weight":87,"slug":88},11,"Presentations",90,"presentations",{"id":90,"doc_module":22,"doc_module_name":25,"category_name":91,"show_sort_weight":92,"slug":93},12,"Resumes",80,"resumes",{"id":95,"doc_module":22,"doc_module_name":25,"category_name":96,"show_sort_weight":97,"slug":98},14,"Invoices",70,"invoices",{"id":100,"doc_module":22,"doc_module_name":25,"category_name":101,"show_sort_weight":102,"slug":103},15,"Posters",60,"posters",{"id":105,"doc_module":22,"doc_module_name":25,"category_name":106,"show_sort_weight":107,"slug":108},16,"Social Media",50,"social-media",{"id":110,"doc_module":22,"doc_module_name":25,"category_name":111,"show_sort_weight":112,"slug":113},17,"Forms",40,"forms",{"id":115,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":116,"slug":117},18,30,"letters",{"id":119,"doc_module":22,"doc_module_name":25,"category_name":120,"show_sort_weight":121,"slug":122},21,"Paper Templates",5,"papers-templates",{"id":124,"doc_module":22,"doc_module_name":25,"category_name":125,"show_sort_weight":4,"slug":126},158,"General","general-158",{"code":4,"msg":82,"data":128},{"doc_id":79,"user_id":129,"nickname":42,"user_avatar":130,"doc_module":22,"category_id":115,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":121,"language":136,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":12,"update_tm":140,"read_time":26},962075114765,"https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd","PURPOSE  \nThe Michigan Department of Health and Human Services (MDHHS) must have privacy protections to ensure that Protected Health Information (PHI) is disclosed to, used by, and may be further disclosed by business associates on its behalf. Data sharing must relate to treatment, payment, health care operations, or other business associate functions as defined in the Health Insurance Portability and Accountability Act (HIPAA) . Such protections will meet the requirements of the (HIPAA) Privacy Rule.  \nDEFINITIONS  \nBusiness Associate (BA)  \nA person or entity not employed by the MDHHS that provides certain functions, activities, or services for or on behalf of the MDHHS, which involves the use and/or disclosure of an individual's protected health information. A business associate also includes (1) any person who transmits protected health information to a covered entity and who requires routine access to such protected health information and (2) a person who offers a personal health record to one or more individuals on behalf of a covered entity. Such activities may include, but are not limited to, patient safety activities, billing, repricing, claims processing and administration, data analysis, legal, accounting, actuarial, consulting, utilization review, quality assurance, and similar services or functions. A business associate may be a covered entity. The definition of a business associate includes subcontractors that create, receive, maintain, or transmit protected health information on behalf of a business associate but excludes a person who is part of the covered entity’s workforce. 45 C. F. R. § 160.103.  \nBusiness Associate Agreement (BAA)  \nUnder the HIPAA Privacy and Security Rules, a legally binding agreement entered into by a covered entity and business associate that establishes permitted and required uses and disclosures of protected health information (PHI), provides obligations for the business associate to safeguard the information and to report any uses or disclosures not provided for in the agreement, and may require termination if violated.  \nCovered Entity (CE)  \nThe entities to which the HIPAA Regulations apply, which include:(a) a health plan; (b) a health care clearinghouse; and (c) a healthcare provider who transmits any health information in electronic form in connection with one of the following eleven (11) transactions: (i) health care claims or equivalent encounter information; (ii) health care payment and remittance advice; (iii) coordination of benefits; (iv) health care claims status; (v) enrollment and disenrollment in a health plan; (vi) eligibility for a health plan; (vii) health plan premium payments; (viii) referral certification and authorization; (ix) first report of injury; (x) health claims attachments; and (xi) other transactions that the Secretary of DHHS may prescribe by regulation. 45 C. F. R. § 160.103.  \nElectronic Protected Health Information (EPHI)  \nElectronic protected health information. Health related data pertaining to an individual who can be identified and is in electronic format.  \nProtected Health Information (EPHI)  \nIndividually identifiable health related information that is collected by a HIPAA covered entity or component and is transmitted by, or maintained in, electronic or any other form or medium.  \nSubcontractor  \nA person or entity to whom a BA delegates a function, activity, or service, other than in the capacity of a member of the Workforce of such BA. For purposes of this Business Associate Agreement Policy/Procedure document, the term “BA” includes  \n“Subcontractors.”  \nWorkforce  \nEmployees, volunteers, trainees, and other persons whose conduct, in the performance of work for a CE or BA, are under the direct control of such CE or BA, whether they are paid by the CE or BA.  \nPOLICY  \nWhen a HIPAA-covered component of MDHHS establishes a business partnership with a person or organization outside of  \nMDHHS, a Business Associate Agreement (BAA) is require","cbCaiu0bMk1S2Vam","https://ap.wps.com/l/cbCaiu0bMk1S2Vam","pdf",200707,"English","# Purpose\n# Definitions\n## Business Associate (BA)\n## Business Associate Agreement (BAA)\n## Covered Entity (CE)\n## Electronic Protected Health Information (EPHI)\n## Subcontractor\n## Workforce\n# Policy\n# Roles and Responsibilities\n## MDHHS Compliance and Data Governance Bureau (CDGB)\n## MDHHS Chief Compliance Officer\n## MDHHS Covered Health Care Components\n## DTMB Purchasing and Procurement","[{\"question\":\"When does MDHHS require a Business Associate Agreement (BAA)?\",\"answer\":\"A BAA is required when a HIPAA-covered MDHHS component establishes a business partnership with an outside person or organization that will need to share Protected Health Information (PHI).\"},{\"question\":\"What information must a party provide before submitting a request for a BAA?\",\"answer\":\"The party must provide the business associate name and a description of how the business associate will use and/or disclose PHI and what protections will be in place.\"},{\"question\":\"What should a business associate do if there is a suspected or confirmed data breach involving MDHHS data?\",\"answer\":\"The business associate must contact CDGB by completing the incident report form (DHHS-1422), after which CDGB evaluates breach scope, reviews mitigation efforts, and approves resolution.\"}]","MDHHS Business Associate Agreement Policy/Procedure | PDF",1789571127]