By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
Health Works CollectiveHealth Works CollectiveHealth Works Collective
  • Health
    • Mental Health
  • Policy and Law
    • Global Healthcare
    • Medical Ethics
  • Medical Innovations
  • News
  • Wellness
  • Tech
Search
© 2023 HealthWorks Collective. All Rights Reserved.
Reading: Due Diligence with Business Associates
Share
Notification Show More
Font ResizerAa
Health Works CollectiveHealth Works Collective
Font ResizerAa
Search
Follow US
  • About
  • Contact
  • Privacy
© 2023 HealthWorks Collective. All Rights Reserved.
Health Works Collective > Uncategorized > Due Diligence with Business Associates
Uncategorized

Due Diligence with Business Associates

onlinetech
onlinetech
Share
5 Min Read
HIMSS Analytics: Due Diligence with Business Associates
SHARE

The latest 2012 HIMSS Analytics Report: Security of Patient Data released in April outlines survey statistics related to data breaches, including preventative measures taken and degree of due diligence with third-party vendors. Commissioned by Kroll Advisory Solutions, the study includes respondents who identify as Chief Security Officers, Senior Information Technology executives, Compliance Officers and Privacy Officers.

The latest 2012 HIMSS Analytics Report: Security of Patient Data released in April outlines survey statistics related to data breaches, including preventative measures taken and degree of due diligence with third-party vendors. Commissioned by Kroll Advisory Solutions, the study includes respondents who identify as Chief Security Officers, Senior Information Technology executives, Compliance Officers and Privacy Officers.

HIMSS Analytics: Due Diligence with Business Associates

HIMSS Analytics: Due Diligence with Business Associates

While 98 percent of respondents require third-party vendors to sign a BAA (business associate agreement), only 50 percent require their business associates to show proof of employee training in HIPAA/security policies. The second most commonly practiced method of due diligence is ensuring business associates have a formal breach notification plan in place.

When it comes to breach notification plans, it is essential to have a clause in place that specifically details the timeline by which the business associate will notify the covered entity when a breach is suspected. Online Tech’s breach notification clause states:

More Read

A healthcare worker assessing a sick
How Health Care Workers Can Boost Their Income with a Simple Calculation
How to Get a Job in HealthCare IT When You Don’t Have Specific Experience
Let’s Talk: Taking Care of Our Parents
Breaking News: HHS Proposes 1 Year Delay to ICD-10
Massive Health Benefits of Using Reliable Carpet Cleaning Services

2.5. Business Associate shall notify Client in writing of any Breach involving Unsecured PHI within five (5) business days of becoming aware of such Breach. All reports of Breaches of Unsecured PHI shall be made in compliance with HITECH Act § 13402 and the regulations issued thereunder.

A Breach will be treated as discovered as of the first day that such Breach is known or reasonably should have been known by Business Associate. Business Associate shall notify Client within seventy-two (72) hours of any suspected or actual Security Incident or breach of security, intrusion or unauthorized use or disclosure of PHI and/or any actual or suspected use or disclosure of data in violation of any applicable federal or state laws or regulations.

The third most commonly used method is ensuring business associates “use tools to secure patient information.” While the report doesn’t offer any additional details around what “tools” they’re referring to, it may vary from one HIPAA hosting provider to another, as the HIPAA rules do not require any one method of achieving the same security standards.

Seventy-six percent checked to ensure their third-party vendor had a plan to identify breaches, different from the 82 percent that sought out business associates with a breach notification plan. Identifying breaches can be achieved with comprehensive monitoring systems that generate logs of activity on servers, as well as Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) that can help pinpoint any attempts at unauthorized access to servers that contain ePHI (electronic protected health information).

Checking for proof of employee background checks and periodic risk analyses both ranked at 56 percent in covered entities’ due diligence of business associates. While low on the list, employee background checks are key when it comes to data breach cases.

According to the HIMSS Analytics Report, the most common perpetrators of security breach incidents are employees (79 percent). Although down from 2010’s 94 percent, this still accounts for the majority of PHI breaches within an organization. While this may be attributed to other factors such as lack of employee training, background checks should be implemented regardless for optimal PHI security.

The U.S. Department of Health and Human Services requires covered entities to conduct periodic risk analyses (read What’s in a HIPAA Risk Analysis?). An emphasis on ‘periodic’ is in order, since, like any audit or analysis, a one-time report only measures the security of an organization during a certain snapshot of time. For assurance of ongoing compliance, check their analysis and the scope of their analysis to do your due diligence.

To get educated on what you need to know about third-party vendors to stay compliant, read our E-Tip, Five Questions to Ask Your HIPAA Hosting Provider. Read our other HIPAA-related E-Tips too.

TAGGED:data breachsecurity
Share This Article
Facebook Copy Link Print
Share

Stay Connected

1.5kFollowersLike
4.5kFollowersFollow
2.8kFollowersPin
136kSubscribersSubscribe

Latest News

contamination
Batch Failures And The Hidden Costs Of Contamination
Health Infographics
October 21, 2025
Medication Management For Seniors
Simplifying Medication Management For Seniors
Infographics Senior Care
October 21, 2025
Guide To Pursuing a Career in Nursing as a Foreigner in the USA
Collaboration Is the Prescription for Better Patient Care
Health
October 20, 2025
Epidemiological Health Benefits
Personal and Epidemiological Health Benefits of Blood Pressure Management
Health
October 13, 2025

You Might also Like

Guest Article: Actionable Advice on ICD-10 Migration

October 17, 2011
healthcare innovation
Uncategorized

6 Technologies That Are Changing the Healthcare Industry

July 29, 2024
hospice care
BusinessHospital AdministrationUncategorized

Understanding the Ins and Outs of Hospice Management

May 17, 2021
money and steth pic
Uncategorized

Health Reward Stat of the Day – Aug 31

August 31, 2015
Subscribe
Subscribe to our newsletter to get our newest articles instantly!
Follow US
© 2008-2025 HealthWorks Collective. All Rights Reserved.
  • About
  • Contact
  • Privacy
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?