Are Your Business Associates Accountable for HIPAA Compliance?
The Department of Health and Human Services' Office for Civil Rights intends to strengthen HIPAA compliance requirements under the HITECH Act. The proposed changes would make BAs directly liable for HIPAA breaches, and subcontractors of BAs would also have to be compliant with HITECH and HIPAA. And that means they would have to comply with the HIPAA Security Rule and the use and disclosures provisions of the HIPAA Privacy Rule.
But is HITECH alone enough to ensure BAs and their subcontractors comply?
Not really, says Rebecca Herold, CISSP, CIPP, CISM, CISA, FLMI, of Rebecca Herold & Associates, LLC, of Des Moines, IA.
A contract satisfies HITECH requirements. In it, make sure you include language that requires physical safeguards and asking BAs to document and prove their security measures and plans for incident response.
Case in point: The theft of an electronic medical records file in Manhattan may affect as many as 1.7 million patients. It is the largest breach since OCR began posting breaches on its website in February 2010. On February 9, The New York City Health and Hospitals Corporation (HHC) reported on its website that it began to notify 1.7 million patients, staff, contractors, vendors, and others who were treated by and/or provided services during the past 20 years.
- MU Compliance Announcement Sparks Concern, Confusion
- New G-Codes to Pay Doctors for Broad Array of Non-Face-to-Face Care
- Scary Financial Challenges for 2014
- MGMA Urges 'End-to-End' ICD-10 Testing
- 1 in 5 CT Screenings for Lung Cancer Results in Overdiagnosis
- Telehealth Improves Patient Care in ICUs
- LifePoint Bolsters Presence in Michigan's Upper Peninsula
- CMS Sets 2014 Pay Rates for Hospital Outpatient and Physician Services
- States Rejecting Medicaid Expansion Forgo Billions in Federal Funds
- Douglas Hawthorne—A Chance to Do Something Big