As many anticipated, the Department of Health and Human Services (HHS) has pushed out a flurry of proposed rules in the months leading up to the Trump administration’s departure. Among them is a Notice of Proposed Rulemaking (NPRM) that would make significant changes to the HIPAA Privacy Rule.
Ever run into a vendor who claims to be a conduit versus a business associate (BA)? It happens all too often, in my experience. Here’s the problem: The conduit exception is a narrow one. If you’re storing protected health information (PHI), even encrypted PHI where you don’t have the encryption key, you’re a BA. Once you sign the business associate agreement (BAA), it applies to you.