HIPAA Business Associate Amendment

[Guest Mel Kiper Jr.]

Under 164.404 the obligation is on the CE to give the breach notice. Anyone seeing the BAAs wanting to send the notice to the individuals and the media (presumably to make themselves look better?). Although there is some appeal to this, I would worry the CE is on the hook if it is screwed up.

Thoughts? What are others doing?

[Guest Mel Kiper Jr.]

Under 164.404 the obligation is on the CE to give the breach notice. Anyone seeing the BAAs wanting to send the notice to the individuals and the media (presumably to make themselves look better?). Although there is some appeal to this, I would worry the CE is on the hook if it is screwed up.

Thoughts? What are others doing?

I think it is ok for them to do it subject to a right of review by the CE. Saves postage!