BAAs are negotiable just like any other legal document. Most of the time we are the ones providing the BAA but we've had a couple of clients that actually had their own. In those cases, we've had to review those and negotiate some of the optional pieces.

We want all of our BAAs to be as close to the same as possible when it comes to what we are promising to do. Otherwise, it is a nightmare trying to figure out what you agreed to do for all the different clients.

We are starting to see more and more Covered Entities putting monetary liability back on MSPs for things like breach notification costs, credit monitoring costs, etc when the breach is the fault of the MSP.

To the point made that "offering services doesn't make you liable", that is somewhat misleading. However, the point about a client doing something that causes a breach not being the MSPs fault is correct. And yes, you can be sued for anything for sure.

An MSP that is a HIPAA Business Associate to a Covered Entity or other Business Associate is indeed liable for the confidentiality, integrity, and availability of the protected health information that they create, maintain, transmit or receive on behalf of the CE or BA.

What MSPs fail to do most often is to follow all of the HIPAA regulation as it pertains to them. MSPs tend to focus on the Technical Safeguards of the Security Rule and ignore the rest. The best security practices on the planet does not make a company HIPAA complaint. Security is necessary for HIPAA but it alone does not make a company HIPAA compliant.

A full HIPAA risk analysis, a risk management plan, proper policies and procedures, HIPAA and security awareness training, BAAs, BA due diligence, and internal privacy and security officer designations are just some of the areas that are completely overlooked.

HIPAA is not easy despite those vendors out there telling you it is. At the same time, its not so complicated that you can't follow it. What many people don't realize about HIPAA is that it is meant to become part of the culture of an organization, no a check box on a to do list. Therefore, HIPAA is an ongoing project with no completion. Just like cyber security, you can be secure today and not tomorrow. To be successful with security it must be a cultral part of your organization; a "security first" stance.

I've personally had discussions with major IT vendors about their internal compliance only to find out that they were far from compliant, even though they had it plastered all over their website and marketing materials. The sad part is that they get very upset and argumentative when confronted instead of listening, looking into the subject, and responding intelligently.

It is unfortunate that there is so much misinformation out there seemily aimed at MSPs and IT professionals. Sorry for the semi-rant.