Guest author William Roberts is an associate in Shipman & Goodwin LLP’s Health Law Practice Group, focusing on health care corporate, regulatory, and compliance matters for hospitals, health systems, insurers, providers, and life sciences companies.
Not every vendor with potential access to PHI is a business associate. IT contractors, cleaning crews, and consultants can still expose you to HIPAA and state privacy violations. A three-part strategy to manage the risk: policies, due diligence, and the right confidentiality agreement.
When a HIPAA breach hits, delay costs money. Build your response team before you need it: a data privacy attorney first (to help protect the investigation under privilege), then forensic and IT consultants, media relations, and HR.
I am asked that question almost weekly. While the answer has traditionally been “no,” the legal landscape is shifting and the risk of being sued continues to increase.
Let’s
A party’s responsibilities under HIPAA generally come from two sources - the law itself and the business associate agreement entered into between the covered entity (the health care provider or
