cognitive cybersecurity intelligence

News and Analysis

Search

To BAA or Not to BAA: Must You Have One? | Holland & Hart LLP

HIPAA requires all business associates involved with handling protected health information (PHI) to perform and document a security risk assessment, set up essential safeguards, execute written agreements, and report security incidents. Any entity violating HIPAA can be fined from $127 to over $1.9 million per violation. To avoid penalties, entities may opt not to become a business associate or execute business associate agreements (BAAs). Those which do not create or handle PHI and those performing management functions can decline BAAs.

Source: www.jdsupra.com –

Subscribe to newsletter

Subscribe to HEAL Security Dispatch for the latest healthcare cybersecurity news and analysis.

More Posts