164.314(a)(2)(iii) Business Associate Contracts with Subcontractors
The requirements of paragraph (a)(2)(i) of this section apply to the contract or other arrangement between a business associate and a subcontractor required by 164.308(b)(4) in the same manner as such requirements apply
8
artefacts
0
held by a system
4
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Records of subcontractor incident notifications · Document repository
- Subcontractor risk assessment results · Policy repository / GRC workspace
- Annual subcontractor review · Document repository
- Evidence that BA enforces same requirements on subcontractors · Document repository
governing documentDocuments that govern the control
- Subcontractor BAA template aligned to 164.314(a)(2)(i) · Document repository
- Executed subcontractor BAAs · Document repository
- Subcontractor inventory with ePHI scope · Policy repository / GRC workspace
- Termination clauses for subcontractor non-compliance · HR system / LMS
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Subcontractor inventory incomplete
- BAA flow-down inconsistent
- Subcontractor risk assessments absent
- Incident notification chain to covered entity unclear
- No periodic review of subcontractor compliance
- Termination clauses not exercised
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet164.314(a)(2)(ii) Other Arrangements (Government) · 164.314(b)(1) Requirements for Group Health Plans (Standard)