Business Associate Agreement Indemnification Language

A covered business may be a counterpart to another insured business. In addition, it is important to note that disclosure by a company covered in PHI to a health care provider for treatment purposes does not have the effect that such a receiving party is a consideration of the public party. “So far, in 2019, trading partners have been implicated in more than a quarter of the major health data violations added to the federal census. The 27 incidents, reported so far in 2019, have involved a total of nearly 690,000 people, according to the HHS website.┬áBefore concluding an BAA, it is important to confirm that there is indeed a HIPAA business relationship and that the BAA is really necessary. Otherwise, the parties assume unnecessary and undesirable liability. Health lawyers are sometimes able to help structuring relationships so as not to interfere with the requirements of the BAA. Given the now direct liability of a counterparty under HIPAA, the question arises as to whether a compensation clause is necessary in an BAA. A compensation clause is intended to compel a party (the compensating party) to repay or cover the obligations of the other party where the actions brought by the compensated party justify the injury. In the hipaa context, it is therefore easy to understand why a covered company wants to force its business partners to compensate them. An example of a pre-omnibus rule may provide a highlight. South Shore Hospital in Massachusetts, a secure entity, was fined for violating HIPAA and Massachusetts Consumer Protection Acts for shipping three cartons of unencrypted electronic information outside the site to erase it, but only one box made it to the destination to erase it.

Although the hospital did not fulfill all of its obligations, it did not ensure that its business partner complied with HIPAA. From the point of view of the insured unit, it asks why it should assume financial responsibility for the actions of its counterpart. Keep in mind that HIPAA compensation is not necessary and do not look beyond the practical ability to effectively enforce the clause in the event of a trigger event. To answer the question of compensation, it is first useful to consider what a BAA covers to an underlying.