If you are accepting liability as a HIPAA business associate you have done something tremendously stupid in your BAA. HIPAA business associates only face direc

If you are accepting liability as a HIPAA business associate you have done something tremendously stupid in your BAA. HIPAA business associates only face direct liability for violating the security rule, improper breach notification, misuse of PHI, etc. As a HIPAA covered entity you are still on the hook for everything else - if your cloud provider has a breach and you can identify that N records were accessed you still get the fine, unless your BA put some sort of liability transfer in the agreement (legal will not be OK with this, so I’m betting not).