Q&A: Business associates and subcontractors

Q: If we work with a business associate (BA) that enters into agreements with BA subcontractors, are we required to obtain copies of these agreements and review them?

A: No, and you do not want to. You have a due diligence responsibility related to your BAs; your BAs have a due diligence responsibility as it relates to their BA subcontractors. You can avoid an added level of risk and liability if you hold your BAs accountable for proper vendor risk management with their vendors rather than you stepping into that role directly.

Editor’s note: Apgar is president of Apgar & Associates LLC, in Portland, Oregon. He is also a BOH editorial advisory board member. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are those of the author and do not represent HCPro or ACDIS.