HIPAA responsibilities when carrier sent wrong file via email

One of our carriers inadvertently sent us a file for another client of theirs.  We sent an internal email to all those who received the email by mistake notifying them that it was sent to them in error and requested a response back that the email had been deleted.  We also notified the carrier and informed them of the same.  The carrier is now requesting that we sign a certification that we in fact deleted the email and did not view it.  Are we under any sort of an obligation to sign this certification?  We notified them of their error and confirmed via email that we deleted the file and did not keep it, but they have said that isn't sufficient, they need a certification signed by us.  This just seems a bit overboard.

I would speak with counsel but, based on the facts set forth above (there may be other considerations, both legal and otherwise, of which I am unaware), I would NOT agree to sign a certification to the carrier.  There is a chance (unlikely as it may be) that it could open you to contractual liability to the carrier if the certification is somehow not 100% correct.

On 1/19/2021 at 12:06 PM, tsrl01 said:

One of our carriers inadvertently sent us a file for another client of theirs.  We sent an internal email to all those who received the email by mistake notifying them that it was sent to them in error and requested a response back that the email had been deleted.  We also notified the carrier and informed them of the same.  The carrier is now requesting that we sign a certification that we in fact deleted the email and did not view it.  Are we under any sort of an obligation to sign this certification?  We notified them of their error and confirmed via email that we deleted the file and did not keep it, but they have said that isn't sufficient, they need a certification signed by us.  This just seems a bit overboard.

No good deed goes unpunished.

On 1/19/2021 at 12:55 PM, Chaz said:

I would speak with counsel but, based on the facts set forth above (there may be other considerations, both legal and otherwise, of which I am unaware), I would NOT agree to sign a certification to the carrier.  There is a chance (unlikely as it may be) that it could open you to contractual liability to the carrier if the certification is somehow not 100% correct.

agree, the file could have been opened and that is putting their mistake on the recipient