HIPAA ‘mega-rule’ adds EHR vendors, storage facilities to business associate list

Why This Topic Matters

Organizations that handle protected health information need to understand which vendors, storage companies, and subcontractors may now fall within HIPAA obligations. The article helps readers identify contract and compliance areas that may need attention to reduce exposure when a business associate is involved in a privacy or security incident.

Article Sections

1. Rule overview and expanded business associate definition

   Introduces the HHS mega-rule and explains the broader compliance context for entities that use, store, maintain, or transmit protected health information. It summarizes the types of organizations newly affected by the updated framework.

2. Contract review and compliance timing

   Discusses the need to review existing vendor and service agreements and the timing considerations tied to updated business associate arrangements. It also notes the role of subcontractors under the revised requirements.

3. What you should do now

   Outlines general next steps for organizations managing business associate relationships. The section focuses on communication, contract renewal review, responsibility allocation, and breach-notification planning.