Sample Provisions for Integrated QSOA/BAA to Disclose PHI with Contractors

Resource developed by the CoE-PHI providing applicable definitions and sample provisions outlining the obligations and activities of a BA/QSO, permitted uses and disclosures by a BA/QSO, and termination of BA/QSO agreements.

Key Points

• During the course of providing substance use disorder treatment, you may need to share PHI with an outside entity for services like accounting or data processing.
• If your program is covered by HIPAA and 42 CFR Part 2 (Part 2), you may only share information if you enter a written contract that complies with both privacy laws: a HIPAA-compliant Business Associate Agreement (BAA) and a Part 2-compliant Qualified Service Organization Agreement (QSOA).