HIPAA Security Rule obligations for vendors that handle PHI for covered entities: whether you are a business associate, subcontractors, health app developers, managed IT providers, billing and practice management companies, and how covered entities assess vendors.
How to tell whether your company is a HIPAA business associate: the regulatory definition and the functions and services it lists, data transmission and personal health record vendors, cloud providers holding encrypted data, and the four exclusions.
When a vendor's own vendors become business associates: subcontractors in the definition, the business associate's duty to get written assurances, contract terms that must flow down, liability for subcontractor breaches and an enforcement case over a missing agreement.
Whether HIPAA applies to a health or wellness app: HHS scenarios where the developer is and is not a business associate, consumer-directed data exchange, interoperability arrangements, and the FTC rules and federal tool for apps outside HIPAA.
What the Security Rule means for MSPs and MSSPs that manage systems holding ePHI: business associate status, direct liability, contract terms, the HICP advice to hand MSPs the small-practice volume, and ransomware cases involving vendors.
Security Rule expectations for billing, revenue cycle and practice management vendors, drawn from OCR cases: missing risk analyses, intrusions that went undetected for months, exposed file servers, subcontractor agreements and 60-day breach notice to clients.
How a covered entity vets and monitors business associates: satisfactory assurances and the contract, cloud SLA terms OCR highlights, the vendor's own risk analysis, breach reporting duties, the proposed annual safeguard verification, and why vendor certificates prove little.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.