This story has been corrected. The initial story instructed providers to submit a business agreement. Providers don’t have to submit anything and only need to have a signed and dated agreement on file by Jan. 25 to qualify for the extension through Sept. 23, 2014.
 
You’ll need to draft and sign a business associate agreement by Friday, Jan. 25, if you don’t already have one in place, to get an extra year to comply with new business associate regulations in the recently released HIPAA mega-rule.
 
The rule expanded the definition of “business associate” to include vendors, contractors and subcontractors for covered entities, including physician practices and home health agencies. That means vendors for electronic health records (EHR) systems and other contractors are required to abide by HIPAA and it’s the providers’ responsibility to make sure they do by Sept. 23.
 
But a little-noticed provision gives providers an additional year from the rule’s Sept. 23, 2013 compliance date to comply with the new business associate requirements if they have an agreement in hand by Jan. 25. Those agreements will be grandfathered in, barring any modification or renewal of the agreement before the grace period runs out Sept. 23, 2014.
 
If you don’t have a HIPAA-compliant agreement by Jan. 25, you’ll be forced to comply with the new standards by Sept. 23, 2013.
 
The extension enables you to focus on compliance with other provisions of the final rule, such as updating policies to reflect changes to the notice of privacy practices and breach notifications.