3 ms·

While technically correct, I think you're glossing over the "legal structure around sharing" bit. In order to share data, there has to be a Business Associates

While technically correct, I think you're glossing over the "legal structure around sharing" bit. In order to share data, there has to be a Business Associates Agreement in place (commonly referred to as a BAA for readers not in the industry.) one of the things that HITECH did was mandate that BA's are ALSO liable for data breaches in the same way covered entities are (provided data is breaches in their custody, of course). This means a BA has to maintain all of the same training and compliance requirements, including physical and logical security and auditing requirements.

chimeracoder 13y ago
> BA's are ALSO liable for data breaches in the same way covered entities are (provided data is breaches in their custody, of course). This means a BA has to maintain all of the same training and compliance requirements, including physical and logical security and auditing requirements. Yes, but none of that matters if your concern is limiting who actually has (legal) access to your data, which I believe was the original concern. Business associates may be liable for data breaches, but OP's concern seems to include the fact that the covered entities don't even have to receive consent from the patient before sending data to the business associate in the first place ("In summary, you can no longer assume confidentially between health providers/monitors and patient interactions, to the detriment of all involved.").