Not every vendor with potential access to PHI is a business associate. IT contractors, cleaning crews, and consultants can still expose you to HIPAA and state privacy violations. A three-part strategy to manage the risk: policies, due diligence, and the right confidentiality agreement.
In 2013, Google began signing HIPAA business associate agreements for Gmail, Calendar, Drive, and Vault. What the agreement covered, which Google services stayed off-limits for PHI, and the safeguards you still need. Check Google’s current terms.
The Final Rule took effect March 26, 2013, with 180 days to comply. How the 180-day rule works for future HIPAA changes, which deadlines didn’t move, and the longer transition for existing business associate agreements.
What every business associate contract must include under the Final Rule: permitted uses, required safeguards, breach reporting, subcontractor terms, and return or destruction of PHI at termination, plus the alternatives for government entities.
A covered entity may share PHI with a business associate once it has written assurance the PHI will be protected. The Final Rule extends that chain to subcontractors: each business associate must get the same assurances from its own.
March 5, 2013. Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach
February 14, 2013. Today, we finish examining the business associate definition, focusing on exceptions, as modified by the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification
February 13, 2013. Today, we finish examining (3)—the third paragraph of four—of the business associate definition, as modified by the Final Rule: Modifications to the HIPAA Privacy, Security,
February 12, 2013. Today, we examine the role of the personal health record vendor in paragraph (3)—the third paragraph of four—of the business associate definition, as modified by
February 11, 2013. Today, we start to examine (3)—the third paragraph of four—of the business associate definition, as modified by the Final Rule: Modifications to the HIPAA Privacy,
February 8, 2013. Today, we examine (1) and (2)—the first two parts of four—of the business associate definition, as modified by the Final Rule: Modifications to the HIPAA
February 7, 2013. Today, we provide the business associate definition, as modified by the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health
