Business Associate Agreements (BAA’s) are an important component to many SMPH projects. These statutorily required agreements ensure that UW partners who receive and handle Protected Health Information (PHI) and Personally Identifiable Information (PII) have the tools necessary to ensure the confidentiality of the data they receive. Although UW Madison most often acts as the Covered Entity in a BAA, it does, on occasion, serve as a Business Associate. The UW Policies related to who is authorized to sign BAA’s in both scenarios are discussed below.
UW as Covered Entity
University of Wisconsin-Madison Policy 6.1 applies when UW-Madison, as the Covered Entity, has hired another entity (i.e. educational institution, data processor, etc.) to perform Business Associate activities. Since Business Associate Activities are usually related to software or the purchase of a service, the Director of Purchasing Services is authorized to sign BAA’s on when UW is the Covered Entity. If your department has a Delegated Purchasing Agent, that person has authority to execute Business Associate Agreements in connection with any agreements within the scope of their signatory authority. Similarly, any other person who has signatory authority may sign BAAs within the scope of their authority, such as RSP for BAAs associated with research. A complete list of signatories and their respective scopes can be found here.
UW as Business Associate
If you are involved in a project that involves the UW providing a service in which it will receive HIPAA PHI, the other party as Covered Entity is required to have a BAA to ensure the UW is properly protecting the confidentiality of the PHI. These agreements require a signature