1. HIPAA/HITECH Privacy and Security “Upstream:” CE, or BA delegating function “Downstream:” BA to which function is delegated “First Tier” BA: BA with direct contract with CE “Second Tier” BA: BA with direct contract with First Tier BA (and Third, Fourth Tier, etc.) “Lower Tier” BAs: BAs below First Tier © 2013Christiansen IT Law1

2. HIPAA/HITECH Privacy and Security CE is only required to have BAC with First Tier BA First Tier BA is only required to have BAC with Second Tier BA And so on © 2013Christiansen IT Law2

3. HIPAA/HITECH Privacy and Security BA Services Provider does not perform delegated function, activity or service BA Services Provider may use, disclose PHI for BA purposes BA Services Provider may use subcontractors, which are not BAs © 2013Christiansen IT Law3