Archive for January, 2013

Why You Should Use a Right to Audit Clause

Thursday, January 24th, 2013

A Tale of Two Viewpoints

When I was responsible for information security and privacy at a large financial and healthcare organization throughout the 1990’s I had literally hundreds of business partner organizations to which we outsourced various types of activities that required some type of access to our client and customer information. Add to that several hundred agents and, scarier still because they were not exclusively selling our products, brokers, and you can probably imagine the angst I felt when thinking about the ways in which all those other organizations were putting our information at risk.  The contracts with them had a very brief requirement to “provide appropriate security controls” for the information, but that did not alleviate my worries. But, since at that time there were no data protection regulations in effect, the lawyers said this simple clause was enough.  And then one of the outsourced entities had an incident resulting from lack of controls which allowed a hacker to enter our network.  (more…)

Should You Rush to Execute a BA Agreement Today? Probably Not

Thursday, January 24th, 2013

The final HIPAA “mega rule” is going to be officially published on the Federal Register tomorrow, January 25, 2013.  Currently the version available (https://s3.amazonaws.com/public-inspection.federalregister.gov/2013-01073.pdf) is “pre-publication” version.

Over the past week I’ve had numerous CEs and BAs contacting me, frantic to change their BA Agreements to “avoid complying with the Mega Rule for another year!” Wait, folks. You are misunderstanding; this is a very specific extension that only applies to the BA Agreements.  Let me explain… (more…)