2.7 Subcontractors. Business Associate will require its subcontractors to provide, through a written agreement, sufficient assurance for compliance with the same obligations, limitations and conditions of data protection and security with respect to PPH and ePHI as those applicable to Business Associate through this BAA. Business Associate may forward PHI to other Covered Entity business partners without requiring the written agreement described here. Counterparties who are notified of a security breach must immediately notify the registered entity so that they can begin correct notification procedures. HIPAA does not indicate which party should pay for notification of violations. A covered entity may delegate payment liability to the counterparty. A lawyer may review the text of this provision in response to business practices. In establishing the rule of application, HIPAA defined the rules under which companies and business partners concerned must comply with the Health and Human Services Department in each HIPAA Injury Investigation, in addition to the consequences and penalties for hipAA violations. 3.7 Other counterparties. Covered Entity is committed to being solely responsible for the compliance of all contractual relationships it has with other business partners with HIPAA privacy and security rules.
The BAA defers the legal risk of the insured unit to the counterparty. A company that signs the BAA and is not a „business associate“ remains subject to contractual liability, disclosure restrictions, compliance fees and penalties for non-compliance – risks that can be discussed with a lawyer. In particular, you have a legal obligation to sign an associate agreement before performing a job. Failure to do so could be a costly mistake. As the common use of online health data and the use of digital and cloud memory increase, organizations within and within each other need an agreement from business partners to be able to work. 5.3 Effect of termination. Unless otherwise stated, the contracting parties agree that at the end of this BAA, Business Associate will return to the covered unit for any reason or, if agreed by Covered Entity, destroy allPHIps received by the insured unit or created, managed or received by Business Associate on behalf of the insured entity.