Good Clinical Practice: A Question and Answer Guide2024/2025 Edition - 341

The HIPAA Privacy Rule and FDA-Regulated Clinical Trials
The HITECH Act also clarified, and in some cases changed, the liability of those who violate HIPAA, and
expanded the criminal and civil liability of covered entities to include business associates (thereby establishing
business associates as covered entities for HIPAA liability purposes). The HITECH Act did not change the amounts
or definitions of criminal penalties, but it did expand and increase civil liabilities substantially.
Prior to the HITECH Rule, covered entity privacy and security regulatory audits were purely complaint driven.
In November 2011, HITECH requires for periodic audits to ensure covered entities and business associates are
complying with the HIPAA Privacy and Security Rules. The Office for Civil Rights (OCR) piloted a program that
includes up to 150 covered entity compliance audits. Audits conducted during the pilot phase began in November
2011 and concluded by December 2012. From the pilot and other activities, the OCR announced in March of 2016
the roll-out of Phase 2 of the OCR HIPAA Audit Program. In its Phase 2 HIPAA Audit Program, OCR reviewed
the policies and procedures employed by covered entities and their business associates to meet selected standards
and implementation specifications of the Privacy, Security, and Breach Notification Rules. While these audits are
primarily desk audits, some onsite audits have been conducted. The audit program is an important part of OCR's
overall compliance activities. The audits present an opportunity to inspect for compliance, identify best practices,
and identify risks that may not have otherwise been recognized. Through the information obtained from the audits,
OCR will develop tools and guidance to further assist the industry in compliance and mitigating risks. OCR will
evaluate the results and procedures used in the phase 2 audits to develop a permanent audit program. For more
information about the updates to the OCR audit program, please go to http://www.hhs.gov/hipaa/for-professionals/
compliance-enforcement/audit/index.html.
There was an update to the HITECH related to telehealth during COVID-19. Refer to Q. 15.1
15.8 Q. Under the HITECH Rule, what are the requirements for business associates? Are sponsors now
considered business associates under the HITECH Rule?
A. The definition and the enforcement jurisdiction related to business associates have been modified by the rule.
Although a business associate under the rule is still an individual or organization that performs a service on behalf
of the covered entity that involves use and/or receipt of PHI from the covered entity in the course of business, now
it includes all entities that create, receive, maintain, or transmit PHI on behalf of a covered entity with the exception
narrowed to data transmission services.
Also, under the rule, data security and privacy requirements for covered entities have been expanded to business
associates. Since some of the largest unauthorized disclosures (breaches) of protected health information (PHI)
reported to HHS have involved business associates, the changes expand many of the covered entity's data protection
requirements and penalties to business associates of covered entities that receive PHI.
This means that business associates must now maintain, like a covered entity, reasonable and appropriate
administrative and physical safeguards to ensure the integrity and confidentiality of health care information, e.g.,
encrypted hard drives and security risk assessment. Business associates are also liable for the increased penalties
for noncompliance based on the level of negligence up to a maximum penalty of $1.5 million. In clinical research,
this may include covered entities' business associates that are contractors or subcontractors that provide services
such as auditing, inspection prep, recruitment, and other clinical research site operational consulting. Note that
every vendor to a business associate is a business associate provided they meet the definition of a business associate.
Business associates are now subject to Security Rule and applicable parts of Privacy Rule. For example, business
associates must appoint a Security Officer, evaluate security programs and conduct appropriate risk assessments,
implement security training, have written policies and procedures and comply with documentation requirements,
and enter into business associate agreements with subcontractors.
Business associates are directly liable for impermissible uses and disclosures, failure to provide breach
notification to covered entity, failure to provide access to PHI to covered entities (or to the individual if specified
in the business associate agreement), failure to disclose PHI to HHS, failure to provide accounting of disclosures,
failure to enter into business associate agreements with subcontractors, failure to comply with the " minimum
necessary rule " when disclosure and use is without authorizations for TPO, and failure to do anything required by
the business associate agreement.
Covered entities current business associate agreements and existing templates will need revision. These additional
requirements for business associate agreement include compliance with Security Rule, breach reporting to the
341

http://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/index.html http://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/index.html

Good Clinical Practice: A Question and Answer Guide2024/2025 Edition

Table of Contents for the Digital Edition of Good Clinical Practice: A Question and Answer Guide2024/2025 Edition