Question 179 - CIPP-US discussion

When handling sensitive data, such as protected health information (PHI) in compliance with HIPAA, it is crucial for covered entities, such as Miraculous Healthcare, to ensure that their business associates (e.g., MedApps) appropriately safeguard the data they process. While contracts like Business Associate Agreements (BAAs) establish the obligations of business associates, active oversight by the covered entity is a practical and necessary step to mitigate privacy risks and ensure compliance.

Why Active Oversight is the Best Option:

Active oversight involves regular monitoring, audits, and reviews of MedApps' practices to ensure they comply with the agreed-upon privacy and security obligations.

This approach allows Miraculous Healthcare to confirm that MedApps is implementing appropriate technical and organizational safeguards, such as encryption, secure access controls, and breach notification processes.

It also ensures that MedApps remains compliant with HIPAA requirements over time, even if there are changes to the app, its services, or legal requirements.

Explanation of Options:

A. Prevent MedApps from using copies of the patient data: While restricting MedApps from creating unnecessary data copies could reduce some risks, it is often impractical, especially for troubleshooting, app hosting, and support purposes. HIPAA does not require outright prevention of data copies, as long as PHI is appropriately safeguarded and used solely for permissible purposes.

B. Require MedApps to obtain consent from all patients: Under HIPAA, covered entities (not business associates) are primarily responsible for obtaining patient consent or authorization where required. MedApps, as a business associate, processes PHI on behalf of Miraculous Healthcare and is not in a position to obtain consent directly from patients.

C. Require MedApps to submit a SOC2 report: A SOC 2 (Service Organization Control 2) report can provide valuable assurance regarding MedApps' security, availability, and confidentiality practices. However, this action alone does not mitigate all risks, as SOC 2 reports are point-in-time assessments and may not reflect ongoing compliance or address specific HIPAA requirements.

D. Engage in active oversight of MedApps: This is the most practical and comprehensive approach. Active oversight includes reviewing MedApps' privacy practices, conducting periodic assessments, and monitoring compliance with the Business Associate Agreement (BAA). It ensures that MedApps continues to protect PHI appropriately and addresses any privacy risks proactively.

Additional Context:

In the context of the optional benchmarking service, Riya should ensure:

The uploaded data is de-identified or aggregated to comply with HIPAA's de-identification standard (45 CFR 164.514) if possible.

The use of PHI for benchmarking is explicitly addressed in the BAA or a separate agreement.

Reference from CIPP/US Materials:

HIPAA Privacy Rule (45 CFR 160.103 and 164.504): Describes the responsibilities of covered entities and business associates, including the need for BAAs and safeguards for PHI.

NIST Privacy Framework and NIST SP 800-53: Provides guidance on implementing oversight mechanisms for third-party risk management.

IAPP CIPP/US Certification Textbook: Discusses the importance of vendor management and active oversight in ensuring privacy compliance.

Conclusion:

Requiring MedApps to submit a SOC 2 report or restricting data use might address specific concerns but would not provide the comprehensive, ongoing protection necessary to reduce risks effectively. Engaging in active oversight is the most practical and effective action to minimize privacy risks while maintaining compliance with HIPAA.