New HIPAA Provisions Place Requirements on Business Associates of Covered Entities

Physicians are not responsible or liable for the actions of their business associates. However, if a physician finds out about a material breach or violation of the contract by the business associate, he or she must take certain steps required by the rules and the agreement.

Given the increased expected enforcement, the now greater penalties and the increasing interest of patients in privacy rights, it is important that physicians appropriately amend Business Associate Agreements. This will give physicians a sense of whether his or her business associates are ready and willing to agree to the new provisions. In addition, if physicians have any concerns about the policies or practices of a business associate, the physician should make efforts to obtain further information and terminate the contract if warranted.

In this climate, it is important that physicians both update and reinvigorate their own HIPAA compliance plan and ensure business associates do the same.