New HIPAA Rules Affect Business Associates And Their Subcontractors

The new HIPAA rules issued by the Department of Health and Human Services have made substantial changes to the way in which covered entities (e.g., hospitals, health insurers, etc…) and their business associates (entities which perform services on behalf of covered entities involving health information) secure and interact with health information.  One of the most significant and far-reaching of these changes relates to the way in which business associates and their subcontractors are regulated. 

The 2009 Health Information Technology for Economic and Clinical Health Act (“HITECH Act”) obligated business associates to comply with much of the HIPAA rules that previously applied to covered entities only.  With certain limited exceptions, the new HIPAA rules extend that reach by broadening the definition of “business associate” to include not only businesses that contract directly with covered entities, but also those that act as subcontractors to business associates and