united-states contract-law software hipaa
Can a software contractor be indemnified against HIPAA?
<p>I'm an independent developer. My client's app manages PHI for US based patient, which means HIPAA rules apply.</p>

<p>From what I understand, HIPAA sees my client's company is the <em>covered entity</em>, and I am a <em>business associate</em>. What my client didn't tell me, and I only recently found out, is that according to the Final Omnibus update, this means I need to be HIPAA compliant too, and am directly liable for fines and lawsuits in case of a data breach, which could be huge sums.</p>

<p>Is there any way that I, as a contractor, can circumvent having to sign a BAA, along with the hassle of setting myself up as being HIPAA compliant, and carrying the risk of being directly pursued for a HIPAA breach?</p>

<p>An independent contractor can be treated as an employee of the covered entity (note that you are not actually an employee, just treated as such for HIPAA purposes).</p>

<p>I got this from a conversation with someone at <a href="http://accountablehq.com/" rel="nofollow noreferrer">Accountable HQ</a> who said this is a question they get asked frequently as this is a very common scenario and source of confusion.</p>

<p>And this is what the <a href="https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html" rel="nofollow noreferrer">official hipaa guidance</a> say:</p>

<blockquote>
  <p>A member of the covered entity’s workforce is not a business associate.</p>
</blockquote>

<p>I presume you would want to state this clearly somewhere in the contract, and the covered entity would want this in their HIPAA compliance documentation.</p>

<p>The covered entity is responsible for ensuring any contractor who has access to PHI receives adequate training on HIPAA. That's quite easily done using a service like <a href="http://accountablehq.com/" rel="nofollow noreferrer">Accountable HQ</a> who will also facilitate the overall admin and documentation required to be HIPAA compliant (no affiliation to me).</p>
