"OCR describes a recent enforcement action involving a health care provider's use of a cloud-service data storage provider without first entering into a business associate agreement with the service provider.... Employers sponsoring group health plans ... would be prudent to verify where their protected health information might be stored and transmitted and whether they have business associate agreement in place with all vendors who come into contact with the protected health information."

MORE >>