» HIPAA Enforcement Guidance Issued for Business Associates

New HHS Fact Sheet Addresses Direct Liability

The U.S. Department of Health & Human Services’ (HHS) Office for Civil Rights (OCR) has issued a fact sheet explaining when a business associate can be directly liable for compliance with the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules.

The fact sheet states that OCR is authorized to take enforcement action against business associates only for:

1. Failing to provide HHS with records and compliance reports, cooperate with investigations and reviews, and provide HHS access to protected health information (PHI) and other compliance information;
2. Retaliating against anyone for filing a HIPAA complaint, participating in an investigation, or opposing a HIPAA violation;
3. Failing to comply with the Security Rule;
4. Failing to notify a covered entity or other business associate of a breach;
5. Impermissible uses and disclosures of PHI;
6. Failing to disclose a copy of electronic PHI to either a covered entity, an individual, or an individual’s designee (whichever is specified in the business associate agreement);
7. Failing to make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request;
8. Failing to provide an accounting of disclosures in certain circumstances;
9. Failing to enter into compliant business associate agreements with subcontractors that create or receive PHI on their behalf; and
10. Failing to take reasonable steps to address a material breach or violation of the subcontractor’s business associate agreement.

Click here to review the new fact sheet. Frequently asked questions on business associates are also available.

Posted by Hallier Benefit Advisors in HR News Alerts