Protecting Health Information -

The privacy of health information is protected by federal rules. These rules, which have been recently updated, affect the handling of “protected health information” (“PHI”) by business associates that process claims or provide data analysis, utilization review, quality assurance, billing, data storage, medical research or other similar services to "covered entities" that use PHI. Covered entities (e.g. hospitals, physicians' practices and health insurance providers) are required to enter into contracts with their business associates handling PHI that protect the privacy and security of patients’ information. Business associates are also required to have agreements with their subcontractors addressing the privacy and security of health information.

Liability for Vendors -

A covered entity can be liable for its business associates’ breaches of privacy or security that compromise individuals’ PHI. Similarly, a business associate is liable for the HIPAA violations of its subcontractor. The law requires covered entities to have contracts with their business associates, and for business associates to have contracts with their subcontractors, specifying the duties and responsibilities of each party for protecting PHI and reporting the improper disclosure of PHI. ("Business Associate Agreements").