In our SLA/MSP agreement, we have a paragraph that can be used as the BAA, but it is limited because its very very very generic, and basically says "Volcano Insurance, Volcano Insurance, Volcano Insurance" for 50 lines. No...no it does not actually. But it is quite generic and states that we don't transfer or store CE information, that's their problem. And any passwords we have are strictly for the systems and not the software, and those passwords are transmitted through encryption and stored encrypted on our systems...and then "Volcano Insurance, Volcano Insurance, Volcano Insurance" for 50 lines.
There is a blurb in our agreement as well, thanks to our lawyer for adding it in there, that states that while that paragraph is in there, and does quasi-count towards the BAA agreement, it is at the discretion of the client to provide a more thorough BAA for us to sign if they so choose, and we can provide one as well.
You should probably talk to your underwriter about this. Maybe even spend a little money talk to a lawyer.
Seriously talk to your insurance agent. I couldn't agree with Mark more here. Once you are done with your insurance agent, go ahead and call your lawyer for a little chat about this as well. Hopefully they are a commercial lawyer with some HIPAA knowledge and can really guide you through this one.
they refuse to follow some of my recommendations regarding email usage, backup encryption and network security.
As for this part, document everything. They refuse it, time and date that. They refuse it again, same thing. Build up a log book of them telling you they don't to switch from Gmail as their email provider. Also, consider giving them the ultimatum. I've told a ex-client that if they don't support me in getting their practice to compliance, and approve the work that needs to get done, then I walk and take all my toys with me. I explained to them that I'm not going to have them sue me because they told me no 6 months ago about swapping out dropbox for something else, and getting the field laptops that are used encrypted. They said "we wouldn't sue you if that happened". If I take their word for it that they wouldn't sue me or at least attempt, I would voluntarily be walking up the gallows and trusting them not to pull the level. Not a risk I'm willing to take.
I talked to my lawyer prior to pulling the plug (removing the agents, AV, etc.), he said I had to give them the 30-day notice (as per the agreement)first and that was all. After that, I can pack it up and head home, it falls on them after that to have a game plan.
I want them to understand their part in HIPAA compliance.
We all do. But if they are so wrapped up in the "costs" of now and not the "costs" of tomorrow, then you will never get through to them. If they simply don't care, then they wont care until it is too late. I say drive the message home, give them an ultimatum with a very tight deadline. So tight in fact that it cuts off the circulation to their brain and they simply say yes or no. The longer you drag this out, the higher the chance you will get pulled down with them when something happens.
Do nothing (am I liable if they do not require me to sign a BAA and I do not have a written contract with them)
Yes, yes, and yes. They don't require you to sign a BAA, but the federal government does. According to the law of highest governing body, if the top requires it, the bottom must do it. Agreement in place or not, it's your skin. While the government will first go after them, they will turn around and sell you out (either because they are being honest or to sue you recover some of the fines they are going to be paying). Always have a written agreement in place. If you don't CYA, then that paddle is going to hurt a lot more.
