HHS Expects Business Associates to be Compliant, Now!

Posted July 8, 2010 12:58 PM by Jack Anderson CEO Compliance Helper    

This excerpt from the NPRM is very important. 

9. Business Associates and Covered Entities and their Contractual Relationsips:

For business associates that have already taken HIPAA-compliant measures to protect the privacy and security of the protected health information in their possession, the proposed rules with their  increased penalties would impose limited burden.

We assume that business associates in compliance with their contracts would have already designated personnel to be responsible for formulating the organization’s privacy and security policies, performed a risk analysis, and invested in hardware and software to prevent and monitor for internal and external breaches of protected health information.

We expect that most business associates make a good-faith effort to follow the terms of their contracts and comply with current security and privacy standards.

For those business associates that have not already adopted HIPAA-compliant

privacy and security standards for protected health information, the risk of criminal and/or civil monetary penalties may spur them to increase their efforts to comply with the privacy and security standards. Up to this point, the consequences of failing to meet the privacy and security standards were limited to a business loss in the form of a terminated contract. In the context of the business associate’s overall business, the risk of losing thecontract may not be a sufficient incentive to warrant investing in added security or establishing privacy policies potentially at significant expense. There may be other more benign reasons such as ignorance of potential threats or lack of knowledgeable personnel on staff.

Regardless of the reason, to avoid the risk of the far more serious penalties in this proposed rule, we expect that business associates and subcontractors that have been lax in their complying with the privacy and security standards may now take steps to enhance their security procedures and strengthen their policies for protecting the privacy of the protected health information under their control.