Legal Memorandum: Shifting of HIPAA Obligations by Contract

Issue: Can a seller of medical devices shift some or all HIPAA risk to a third party by contract?

Area of Law: Healthcare & Pharmaceutical Law Compliance
Keywords: Shifting of risk; Seller of medical devices; Contract
Jurisdiction: Federal, Minnesota
Cited Cases: None
Cited Statutes: 42 C.F.R. § 160.402(c); 75 Fed. Reg. No. 134, pp. 40868, 40879
Date: 11/01/2010

Under the currently effective rule, there is presently a limited ability to shift certain HIPAA obligations by contract.  At least four requirements must be met, including:  (1) the agent to whom the obligation is transferred is a business associate; (2) the relevant business associate agreement requirements have been met; (3) the transferor covered entity did not know of a pattern or practice of the transferee business associate in violation of the contract; and (4) the covered entity did not fail to act in compliance with the security and privacy rules.  42 C.F.R. § 160.402(c).  However, the proposed final rule would partially eliminate this limited ability to transfer risk.

 As stated in the official comments to the revised rule:


We propose to remove this exception to principal liability for the covered entity so that the covered entity remains liable for the acts of its business associate agents, regardless of whether the covered entity has a compliant business associate agreement in place. This change is necessary to ensure, where the covered entity has contracted out a particular obligation under the HIPAA Rules, such as the requirement to provide individuals with a notice of privacy practices, that the covered entity remains liable for the failure of its business associate to perform that obligation on the covered entity’s behalf.


75 Fed. Reg. No. 134, pp. 40868, 40879 (July 14, 2010) (http://edocket.access.gpo.gov/2010/pdf/2010-16718.pdf). 

On the other hand, even under the proposed new rule, […]

Subscribe to Litigation Pathfinder

To get the full-text of this Legal Memorandum ... and more!

(Month-to-month and annual subscriptions available)