Security provisions require implementation of administrative, physical, and technical safeguards consistent with the HIPAA Security Rule, reporting of security incidents and breaches, and flow-down of obligations to subcontractors.
Specific technical requirements may be negotiated beyond the regulatory minimum.
Alternative Names:
BAA Security Terms, Security Provisions in BAA
Why it Matters?
The regulatory minimum is a floor rather than a specification, since the Security Rule's addressable standards leave substantial discretion. Agreements that recite the regulation without specifying encryption, access control, and breach notification timing leave the actual protections undefined. Negotiating specific technical terms and a notification period measured in hours is what converts the agreement from a compliance formality into a meaningful control.
Frequently Confused with
Related terms
Frequently asked questions
Is reciting the regulation sufficient?
What should be negotiated beyond the minimum?
