HIPAA Vendor Assessments

HIPAA Analytics offers healthcare providers, vendor (Business Associates) due diligence consulting to ensure vendors meet required levels of HIPAA privacy and security. The assessment process is generally customized to meet provider requirements that focus on the nature of the vendor services, business process, types of data, and technology that support the provider. Depending on the scope of the assessment, project tasks may include;

  • Developing a due diligence vendor questionnaire and supporting the vendor completion.
  • Providing validation of questionnaire responses.
  • Providing ongoing activities related to the development, implementation, maintenance, and adherence to the vendors policies and procedures covering the privacy and security of patient protected health information (PHI) in compliance with federal and state laws.
  • Collaborate with vendor business and technology departments to define and develop compliance policies and procedures in connection with provider/vendor service agreements.
  • Coordinating and communicating due diligence requests with contacts within the vendor business units and other third-party service providers
  • Evaluate and score due diligence materials related to a vendors HIPAA privacy and security compliance program.
  • Work closely with vendors to remediate any gaps or weaknesses related to a vendor’s compliance program.
  • Provide training to vendor business units related to the requirements for complying with the provider contract and business associate agreement.
  • Review, revise and, at times, draft policies, procedures, and guidelines to ensure business processes are in compliance with provider and vendor program.
  • Develop and maintain reports to communicate to provider compliance issues found or non-compliance with the vendor compliance program.
  • Develop and/or enhance tools to assist vendor in complying with provider contract and vendor business associate agreement.

Contact us for more information on HIPAA vendor assessments and services.

Based in Minneapolis/St. Paul, MN we are centrally located to serve clients anywhere in the nation.



Business Associate Strategy and the HITECH Act

Expanded Scope and Enforcement of HIPAA

Whether you are a hospital, insurance company or a vendor to healthcare, recent federal legislation has dramatically changed the rules regarding privacy and security compliance.

On February 17, 2009, President Obama signed into law the American Recovery and Reinvestment Act of 2009 [PDF], which contained provisions comprising the Health Information Technology for Economic and Clinical Health Act, or HITECH Act (“Act”). The Act makes sweeping changes to the privacy and security regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

The Act imposes additional privacy and security rules on business associates. For example, The Act provides for the business associate’s compliance with the terms of the business associate agreement a direct requirement of HIPAA. The Act also applies the administrative, physical and technical safeguard requirements of the security rule to business associates, including obligations related to policies, procedures and documentation.

Additionally, new data security breach notification requirements within the Act now apply to both covered entities and business associates, requiring patient notification of any unauthorized acquisition, access, use or disclosure of their unsecured protected health information. Moreover, increased civil and criminal penalties now apply to violations of HIPAA privacy and security requirements and authorize state attorneys general to bring civil actions on behalf of state residents adversely affected or threatened by such violations.

Healthcare organizations are faced with a growing trend of sharing confidential health information with vendors (business associates) in order to meet critical business needs, yet from a risk management perspective, little if any measurement of business associate compliance knowledge is evaluated, leaving little assurance of sound compliance practices by the business associate handling patient confidential health information.

Privacy violations and security data loss by business associates and their sub-contractors have also become a strategic liability issue for healthcare organizations. For example, new security breach notification rules of the require patients be notified of any unauthorized acquisition, access, use or disclosure of their unsecured protected health information. New security breach notification requirements apply to covered entities and require business associates to notify covered entities of any unauthorized acquisition, access, use or disclosure of their unsecured protected health information they hold on behalf of the covered entity, including the identity of each individual who is the subject of the unsecured protected health information.

According to the Ponemon Institute [PDF], a privacy and information management research firm, the data breach incident cost to U.S. companies is $202 per compromised customer record in 2008. Cost factors include, expensive outlays for detection, escalation, notification and response, along with legal, investigative and administrative expenses, customer defections, opportunity loss, reputation management, and costs associated with customer support such as information hotlines and credit monitoring subscriptions.

Bottom line. Make sure you have updated business associate agreements* in place by February 17, 2010.

*To view a sample HITECH Act Business Associate Agreement, view the RECENT ARTICLES section above entitled Healthdatamanagement.com—February 9, 2010 — New Model BA Agreement, or simply click here to go directly to the site.

Grant Peterson, J.D. leads the HIPAA Analytics team. For questions or comments, please refer to Contact Us