Business Associates BAs are now directly liable under the HIPAA rules: For impermissible uses and disclosures For failure to provide breach notification to EBD For failure to provide access of Electronic PHI either to the individual or EBD For failure to disclose PHI to the Secretary of HHS For failure to provide an accounting of disclosures For failure to comply with the requirements of the HIPAA Privacy and Security Rules BAs must comply with the Minimum Necessary principle
{}