The rate at which cybercriminals target healthcare organizations continues to rise, and the consequences of the attacks are becoming more severe. Two recent high-profile attacks illustrated the urgent need for healthcare organizations to defend against cyberattacks, particularly those involving ransomware, and the importance of comprehensive backup policies and procedures to continue operations in the event of an attack that compromises the network.
The complexity and competitiveness of today’s business environment require that organizations have early warning systems to identify times when they face certain risks. Compliance officers should be active participants in the organization’s risk assessment process.
Q: If we end a contract with a business associate (BA), does the BA need to provide us with assurance that all protected health information (PHI) has been destroyed? Is this something that should be written into the initial contract? What are the steps to take if the BA does not respond to requests to confirm deletion of PHI?