Law Firms

What arrives

The business associate: HIPAA, 45 CFR 160.103. A firm providing legal services to a covered entity that involve protected health information is a business associate.; Source
The 60-day report: 45 CFR 164.410. A business associate reports a breach to the covered entity without unreasonable delay, and no later than 60 calendar days after discovery.; Source
The BAA: HIPAA business associate contract, 45 CFR 164.504(e), including the business associate's duty to report breaches of unsecured protected health information to the covered entity.; Source
The client's vendor policy: New York DFS 23 NYCRR 500.11. A regulated financial client's written policy for the security of its systems and nonpublic information held by service providers.; Source
Rule 1.6(c) and Opinion 483: ABA Model Rule 1.6(c), with Formal Opinions 477R and 483. Reasonable efforts to protect client information, and a duty to notify clients after a breach.; Source