IANAL. It is not a HIPPA violation if Experian has signed a BAA with the hospital. It's on the hospital to perform the due diligence checks, to verify that Expe

IANAL. It is not a HIPPA violation if Experian has signed a BAA with the hospital. It's on the hospital to perform the due diligence checks, to verify that Experian's capable of upholding the terms of the BAA. This article talks about how Experian have SOC-2 issues, which is a cause for concern, but smaller hospitals with tighter budgets could be inclined to look past it. In general, it's important to understand that HIPPA doesn't prevent data from being shared, it gives it a legal framework to be shared within. When things go bad, the HIPPA-associated paperwork provides a roadmap for assigning liability. Liability does get assigned, and companies (providers, insurers, network providers) are held responsible, despite the popular imagination: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf