With a nearing enforcement date for the final HIPAA Omnibus Rule, Healthcare Info Security reports on whether U.S. regulators will enforce actions against foreign business associates (BAs) and subcontractors. “It’s a mess,” said Wiley Rein Partner Kirk Nahra, CIPP/US. “There’s a lot of uncertainty.” If there is a breach with a foreign vendor, the ability for the Department of Health and Human Services (HHS) to take action is unclear. Though a BA would be subject to a breach of contract agreement with a covered entity, Davis Wright Tremaine Partner Adam Greene noted, "it is untested…whether HHS has jurisdiction to bring an (enforcement) action,” adding, “HIPAA, unlike certain other federal statutes, does not have explicit extra-territorial reach.” Additionally, Becker’s ASC Review has posted 15 things to know before the final rule’s deadline. Editor’s Note: For more on complying with the final HIPAA Omnibus Rule, see Close-Up: HIPAA.
Full Story