The U.S. Department of Health and Human Services' Office for Civil Rights released a fact sheet on the provisions a business associate can be held liable for violations of Health Insurance Portability and Accountability Act Rules. The OCR has the authority to take enforcement actions against business associates for their failure to provide breach notifications to a covered entity, impermissible use and disclosure of personal health information, failure to undertake a responsible effort to limit the amount of PHI needed for an intended task, and failure to provide compliance reports or cooperate with complaint investigations and compliance reviews.
Full Story