Home Health & Hospice Week

If you think you can cut some bureaucratic red tape by partnering with vendors outside of the U.S., think again.

HIPAA regulations still apply to vendor relationships, even when they are not based in the U.S. That goes for all of the rules about electronic protected health information (ePHI), including the need for business associate agreements (BAAs).

“Be aware that HHS Office for Civil Rights [OCR] warns of increased risk to ePHI processed or stored outside of the U.S., especially if the server is in a country where cybersecurity risk is high,” says Grant Elliott, CEO of Ostendio and co-founder and president of the Healthcare Cloud Coalition.

“More cloud service providers are touching ePHI every day,” Elliot continues. “While the OCR provides sample Business Associate Contract provisions as they relate to the HIPAA Privacy, Security, Breach Notification and Enforcement Rules, it doesn’t state specifically how the contracted parties can be sure that the provisions are followed.”

OCR guidance on writing up BAAs is online at www.hhs.gov/hipaa/for-professionals/coveredentities/sample-business-associate-agreementprovisions/index.html.