Question
A cloud transcription vendor hired by a hospital's medical records company (itself a business associate) begins storing dictated notes containing PHI. The hospital never signed anything directly with the transcription vendor. Is the vendor still bound by HIPAA obligations, and why?
Tap card to flipAnswer
Yes. Under the Omnibus Rule, a subcontractor that creates, receives, maintains, or transmits PHI on behalf of a business associate is itself a business associate, regardless of whether it has a direct contract with the covered entity. The obligation flows down the chain: the medical records company must execute a business associate agreement with the transcription vendor containing the same required safeguards, and the vendor is independently liable for HIPAA violations even though its only contractual relationship is with another business associate, not the hospital itself.
Tap card to flip back