PART 3 OF 4: The Healthcare-Specific Issues
Data, HIPAA, and compliance terms a general review would miss.
Because they serve a medical practice, vendor contracts raise issues that an ordinary business would never consider. A vendor that touches patient information or the practice's clinical operations brings compliance and data obligations into the contract. This part addresses the healthcare-specific issues in vendor contracts.
Data ownership and access
One of the most important questions in a healthcare vendor contract is who owns and controls the practice's data, and how the practice gets it back. With an EHR or billing vendor in particular, the practice's patient and financial data lives in the vendor's system, and the contract should guarantee the practice's ownership, ongoing access, and the ability to retrieve its data, in a usable format, if the relationship ends.
HIPAA and the business associate agreement
Any vendor that creates, receives, maintains, or transmits protected health information is a business associate and must be under a business associate agreement. The vendor contract should require one, and the business associate agreement's terms matter: how the vendor safeguards data, what it must do in a breach, and its obligations on termination. Signing a vendor up without a proper business associate agreement is a serious compliance gap.
Breach responsibility
The contract should address what happens if the vendor suffers a data breach affecting the practice's patients:
- The vendor's obligation to notify the practice promptly.
- Who bears the cost of breach response and notification.
- The vendor's security obligations and any audit rights.
- Indemnification for a breach caused by the vendor.
Compliance and regulatory change
A healthcare vendor contract should require the vendor to comply with applicable healthcare laws and should account for the possibility that those laws change during the term. A vendor whose service must remain compliant, such as a billing vendor, should be contractually obligated to keep it so.
Why the standard contract misses these
A vendor's standard form, especially from a vendor that serves many industries, may not adequately address these healthcare-specific issues. The practice cannot assume the contract covers data ownership, HIPAA, and breach responsibility appropriately; it must confirm that it does, and add what is missing.
How West Coast Health Law Can Help
We make sure healthcare vendor contracts properly address data ownership, HIPAA and the business associate agreement, breach responsibility, and compliance.
West Coast Health Law offers a FREE consultation which you may schedule by clicking the button on our website.
This article is provided for general informational purposes only and does not constitute legal advice or create an attorney-client relationship. Laws change and every practice is different; consult a qualified attorney about your specific circumstances.
