Over the past few weeks, as the crisis around COVID-19 has escalated, the federal government has taken steps to empower medical providers to continue caring for patients, wherever they might be, in response to social distancing and self-quarantine directives. Specifically, the U.S. Department of Health and Human Services (HHS) and the Office for Civil Rights (OCR), the agencies tasked with administration and enforcement of HIPAA regulations, have issued several bulletins which provide guidance to Covered Entities and Business Associates around maintaining patient privacy when using telemedicine practices to treat patients during the COVID-19 public health crisis.

On May 24, 2019, the Office of Civil Rights (OCR) – the arm of the Department of Health and Human Services that enforces the Health Insurance Portability and Accountability Act (HIPAA) – issued a new fact sheet clarifying the specific instances in which a business associate can be found directly liable for violations of the HIPAA Privacy, Security, Breach Notification and Enforcement Rules (“HIPAA Rules”). As you may know, prior to the promulgation of the 2013 HIPAA Final Rule, liability of business associates could arise only under the terms of a business associate agreement.

As a start-up tech company, you’ve likely poured hundreds of hours into the development and testing of a marketable product, and have pitched your idea to countless investor groups and prospective customers. After your product is launched and customers are being signed up, a whole new set of concerns will present themselves. For start-ups targeting customers in the healthcare industry, these concerns will likely include the adoption of critical compliance and risk mitigation protocols mandated by HIPAA for the so-called “Business Associates” of “Covered Entities.”

In the wake of an historic, multi-state lawsuit filed against a “Business Associate” earlier this month, it is imperative that companies with business associate agreements (BAA) in place with health care/plan customers review internal data security policies and procedures to ensure they are in compliance with their obligations arising under HIPAA, state privacy laws and the BAAs.