Survey: Hospitals Ready to Oversee BAs

One-third of health care business associates interviewed for a small survey were not aware that they now must adhere to the HIPAA privacy and security rules as if they were covered entities. The HITECH Act within the American Recovery and Reinvestment Act significantly enhanced both rules.

But 85% of surveyed hospital I.T. executives said they would take steps to ensure business associates do not breach patient data. And 47% of the hospital executives said business associates that violate the rules would have their contracts terminated. Many surveyed business associates were unaware that their hospital clients may be increasing oversight.

A business associate provides contracted services to covered entities. These functions could include claims processing, claims repricing, data analysis, utilization review, quality assurance, billing and practice management, among others.

The HIMSS Analytics research arm of the Chicago-based Healthcare Information and Management Systems Society conducted the survey. ID Experts, a Beaverton, Ore.-based data breach prevention and remediation firm, commissioned it. HIMSS Analytics in September and October conducted telephone interviews with 150 senior hospital I.T. executives and 26 business associate organizations. Survey findings include:

* Half of surveyed large hospitals experienced at least one data breach this year;
* Sixty-eight percent of surveyed hospitals believe expanded breach notification requirements will result in the discovery and reporting of more breach incidents; and
* Ninety percent of hospital respondents have changed or plan to change policies and procedures to prevent and detect breaches.

For a copy of the 18-page report, "Evaluating HITECH's Impact on Healthcare Privacy and Security," which includes recommendations for business associates, click here. Registration is required.

--Joseph Goedert