On Wed, May 13, 2015 at 9:11 AM, mwhaider <[log in to unmask]> wrote:

> I'm guessing that Suburban Lung Associates used FileFax (no web presence
> but apparently a moving/storage company) because they were cheap (yes that
> is my cynical nature talking).  Does Suburban Lung Associates have
> a contract that includes the requirements for handling PHI?​  Perhaps they
> did not verify the facility or processes, so it seems they should have some
> liability in this incident?  Yes it will be interesting . . .
>

If Suburban Lung Associates handles HIPAA and we seem to know they do, then
DHHS requires they have a "Business Associates Agreement" in place with any
third party providers they transfer custody of the information to

If they didn't have a BAA in place, they'll take to total hit
themselves.... but seeing as the AG went after FileFax, there must be one.



-- 
Larry
[log in to unmask]



*----Lawrence J. MedinaDanville, CARIM Professional since 1972*

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]