"Keeping track of [business associate (BA)] relationships can be a challenge for large covered entities, as those facilities can often have numerous BAs in place. The origin of the relationship could also affect this, that some are managed by legal or compliance departments.... [One] question centered on self-insured organizations, and how that related to HIPAA requirements. Essentially, as a covered entity, do they carry out risk assessments and what is the reasonable period to do that? ... [It] is easier to do risk assessments when they have been broken down into smaller sections."  MORE >>