Get IT support leads in the US

HHS says plainly that an IT contractor or vendor, including a managed services provider, that provides maintenance or support for systems and in doing so creates, receives, maintains or transmits electronic protected health information is a business associate of the covered entity. So is a cloud service provider engaged to store or process that information. The practice must obtain a written business associate agreement before disclosing patient information, and the business associate is directly liable for certain provisions of the HIPAA Rules, not merely contractually liable to the clinic.

The chain keeps going. HHS states that a business associate must have its own agreement in place with a subcontractor before disclosing protected health information to it, and that all downstream subcontractors are themselves business associates. If your IT firm uses an offshore help desk or a third-party backup vendor, those agreements have to exist too.

For firms handling customer financial information, the FTC's Safeguards Rule requires a written information security program with nine elements, including designating a qualified individual to run it, a written risk assessment, multi-factor authentication, and oversight of service providers through contracts that spell out security expectations. The FTC notes the rule reaches many non-bank businesses defined by activity rather than by name, such as mortgage lenders, tax preparation firms and investment advisers. If you are one of those, your IT provider is a service provider under that rule and the contract needs to say so.

Sources: HHS: Business Associates (HIPAA) · HHS: HIPAA Breach Notification Rule · FTC: Safeguards Rule, what your business needs to know · FTC: Data Breach Response, a guide for business · CISA: Cyber Essentials · NIST releases version 2.0 of the Cybersecurity Framework · California Attorney General: Submitting data security breach notifications