Can a software contractor be indemnified against HIPAA?

Question

I'm an independent developer. My client's app manages PHI for US based patient, which means HIPAA rules apply.

From what I understand, HIPAA sees my client's company is the covered entity, and I am a business associate. What my client didn't tell me, and I only recently found out, is that according to the Final Omnibus update, this means I need to be HIPAA compliant too, and am directly liable for fines and lawsuits in case of a data breach, which could be huge sums.

Is there any way that I, as a contractor, can circumvent having to sign a BAA, along with the hassle of setting myself up as being HIPAA compliant, and carrying the risk of being directly pursued for a HIPAA breach?

Answer 1

An independent contractor can be treated as an employee of the covered entity (note that you are not actually an employee, just treated as such for HIPAA purposes).

I got this from a conversation with someone at Accountable HQ who said this is a question they get asked frequently as this is a very common scenario and source of confusion.

And this is what the official hipaa guidance say:

A member of the covered entity’s workforce is not a business associate.

I presume you would want to state this clearly somewhere in the contract, and the covered entity would want this in their HIPAA compliance documentation.

The covered entity is responsible for ensuring any contractor who has access to PHI receives adequate training on HIPAA. That's quite easily done using a service like Accountable HQ who will also facilitate the overall admin and documentation required to be HIPAA compliant (no affiliation to me).