[{"innerBlocks":[],"name":"core\/freeform","postId":839,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"The HHS Office for Civil Rights has issued a fact sheet listing all situations for which a healthcare business associate can be held liable for not following the rules.

The federal agency issued the information to help business associates better understand their liability for complying with HIPAA privacy, security, breach notification and enforcement rules under the HITECH Act.

The fact sheet is timely in the wake of a huge data breach in June suffered by Quest Diagnostics, a nationwide laboratory chain, after a billing and collections business associate of Quest reported unauthorized access to its information systems, which potentially could jeopardize the data of 11.9 million Quest patients. The same contractor also put at risk patient information held by LabCorp, a major medical testing firm.

In accordance with HITECH rules, OCR has authority to take action against BAs for 10 types of transgressions. They include:

\u2022\tFailing to provide the Secretary of Health and Human Services with records and compliance reports, and failing to cooperate with complaint investigations and compliance reviews.

\u2022\tTaking any retaliatory action against anyone for filing a HIPAA complaint, participating in an investigation or other enforcement process, or opposing an act or practice that is unlawful under HIPAA rules.

\u2022\tFailing to comply with the requirements of the Security Rule.

\u2022\tFailing to provide breach notification to a covered entity or another business associate.

\u2022\tImpermissibly using and disclosing protected health information.

\u2022\tFailing to disclose a copy of electronic PHI to either the covered entity, the individual or the individual\u2019s designee, to satisfy a covered entity\u2019s obligations about the form and format of access, and the time and manner of access under rule 45 C.F.R.164.524(c)(2) (ii) and 3(ii), respectively.

\u2022\tFailing to make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

\u2022\tFailing in certain circumstances to provide an accounting of disclosures.

\u2022\tFailing to enter into business associate agreements with subcontractors that create or receive PHI on their behalf, and failing to comply with the implementation specifications for such agreements.

\u2022\tFailing to take reasonable steps to address a material breach or violation of the subcontractor\u2019s business associate agreement.

More comprehensive background and guidance is available here<\/a>.
","saveContent":"The HHS Office for Civil Rights has issued a fact sheet listing all situations for which a healthcare business associate can be held liable for not following the rules.

The federal agency issued the information to help business associates better understand their liability for complying with HIPAA privacy, security, breach notification and enforcement rules under the HITECH Act.

The fact sheet is timely in the wake of a huge data breach in June suffered by Quest Diagnostics, a nationwide laboratory chain, after a billing and collections business associate of Quest reported unauthorized access to its information systems, which potentially could jeopardize the data of 11.9 million Quest patients. The same contractor also put at risk patient information held by LabCorp, a major medical testing firm.

In accordance with HITECH rules, OCR has authority to take action against BAs for 10 types of transgressions. They include:

\u2022\tFailing to provide the Secretary of Health and Human Services with records and compliance reports, and failing to cooperate with complaint investigations and compliance reviews.

\u2022\tTaking any retaliatory action against anyone for filing a HIPAA complaint, participating in an investigation or other enforcement process, or opposing an act or practice that is unlawful under HIPAA rules.

\u2022\tFailing to comply with the requirements of the Security Rule.

\u2022\tFailing to provide breach notification to a covered entity or another business associate.

\u2022\tImpermissibly using and disclosing protected health information.

\u2022\tFailing to disclose a copy of electronic PHI to either the covered entity, the individual or the individual\u2019s designee, to satisfy a covered entity\u2019s obligations about the form and format of access, and the time and manner of access under rule 45 C.F.R.164.524(c)(2) (ii) and 3(ii), respectively.

\u2022\tFailing to make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

\u2022\tFailing in certain circumstances to provide an accounting of disclosures.

\u2022\tFailing to enter into business associate agreements with subcontractors that create or receive PHI on their behalf, and failing to comply with the implementation specifications for such agreements.

\u2022\tFailing to take reasonable steps to address a material breach or violation of the subcontractor\u2019s business associate agreement.

More comprehensive background and guidance is available here<\/a>.
","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

OCR issues guidance on BA liability in protecting health data

More for you