Cyber Risks a University Faces as a HIPAA Business Associate

Abstract

This article discusses the impact a breach of protected health information (PHI) may have on a university while it acts as a HIPAA business associate of an external covered entity. While much has been written about breaches affecting covered entities, scant attention has been paid to the risk a third party such as a university assumes by deciding to become a business associate.