Are Your Software Partners Signing BAA Agreements?

If you’re a healthcare professional of any kind, you’re doubtless familiar with the ins and outs of the Health Insurance Portability and Accountability Act, or HIPAA. A key facet of this piece of legislation is the Privacy Rule. The Privacy Rule protects all “individually identified health information,” also known as Protected Health Information (PHI), in any form, held or transmitted by a Covered Entity or its Business Associate.

Nearly all healthcare entities are considered a Covered Entity, while Business Associates are entities that provide third-party services to Covered Entities, in which they will encounter PHI. These include cloud storage services, IT contractors, and yes, even your mileage tracking and reimbursement software. 

Apps that record information for healthcare workers inevitably store PHI, whether they’re tracking expenses, trips, or other activities. In order for your mileage reimbursement software – and your organization – to stay in compliance with HIPAA, third-party service providers must sign a Business Associates Agreement, or BAA. This agreement serves as a contract, specifying each party’s responsibilities regarding the handling of PHI. 

While BAAs protect both Covered Entities and their Business Associates, some software providers still resist signing them. A refusal by a business associate to sign should raise serious concerns about that vendor’s commitment to compliance, as well as their attitude towards data security. 

Why Should You Ask Your Software Vendors to Sign a BAA?

A BAA creates a legal obligation for a vendor or third-party service to safeguard any PHI they may encounter, in compliance with the standards established by HIPAA. By requiring vendors to implement administrative, technical, and physical safeguards, BAAs establish accountability, with the ultimate aim of keeping clients’ information confidential and secure. The absence of a BAA can expose the Covered Entity to liability for any HIPAA breaches, even ones outside that entity’s direct control.

Why Some Vendors Refuse to Sign BAAs

A responsible vendor should have no problem signing a BAA. So why do some companies refuse?

Cost and Complexity of Compliance

Some vendors won’t sign a BAA to avoid the investment required to adequately meet HIPAA security and privacy requirements. 

Business Model Limitations

If a provider or third party is not designed for the healthcare industry, that organization may lack the infrastructure to securely handle PHI.

Risk Avoidance

Signing a BAA places legal responsibility for any breaches of HIPAA on the vendor. Many vendors may refuse to sign, preferring that any PHI-related breaches shift entirely to their client, the Covered Entity. 

Incompatible Data Practices

Some software manufacturers or other vendors make use of data for analytics, advertising, or third-party sharing in a way that could potentially conflict with HIPAA restrictions.

Lack of Awareness or Expertise 

Newer or smaller-scale vendors may not fully understand the obligations posed by HIPAA. In that case, the organization may decline to sign a BAA because they have no desire to learn, and wish to sidestep the matter entirely. 

Look Out for These Red Flags

When seeking partnerships with third-party companies, keep a close eye for signs that that vendor doesn’t take HIPAA compliance seriously, and might decline to sign a BAA. Signs like:

• Vague or evasive responses when asked about HIPAA compliance
• A reliance on claims of “general data security,” without specific mention of protections for PHI
• Attempts to use contracts to transfer all liability for any breaches to the healthcare provider
• Any reluctance to discuss internal security practices, or provide audit results 

The Bottom Line 

Your organization takes HIPAA regulations seriously, and so should any Business Associate that works with your company. Noncompliance can lead to significant regulatory penalties and operational disruptions for you as a healthcare provider, even if that breach does originate with a third party. 

However, HIPAA violations have deeper repercussions besides legal or regulatory penalties. Every day, patients and clients trust your company to keep their private information safe. A vendor compromising PHI due to negligence seriously endangers that trust. 

To that end, a vendor’s refusal to sign a BAA should be disqualifying for your company. In refusing to sign, they open you up to liability, and potentially put patient data at risk. 

CompanyMileage Keeps Expense Management Secure

CompanyMileage is dedicated to providing businesses with automated solutions for easy, intuitive and efficient mileage reimbursement. Our mileage reimbursement software, SureMileage, simplifies mileage tracking by using point-to-point calculations to determine the best route for reimbursement between start and end points of each work-related trip. That way, busy, on-the-go healthcare workers don’t have to waste time and energy on keeping mileage spreadsheets or subtracting odometer readings.

Our commitment to our clients extends to maintaining the levels of security and compliance that meet or exceed standards set by HIPAA. In accordance with the HIPAA security rule, CompanyMileage encrypts data at NIST standards, uses secure logins and PINs, and maintains secure servers and internal firewalls. We also use policies and procedures to safeguard PHI, and yes, a key part of those policies and procedures is the BAA we sign with all of our clients in the healthcare industry. 

At CompanyMileage, we always have our clients’ best interests at heart, and we’re happy to sign a BAA whenever necessary. Can all expense management companies say the same?

To find out more about CompanyMileage, and how our products can save you up to 25% on mileage reimbursement, contact us for a demo today!