I'm an independent developer. My client's app manages PHI for US based patient, which means HIPAA rules apply.
From what I understand, HIPAA sees my client's company is the covered entity, and I am a business associate. What my client didn't tell me, and I only recently found out, is that according to the Final Omnibus update, this means I need to be HIPAA compliant too, and am directly liable for fines and lawsuits in case of a data breach, which could be huge sums.
Is there any way that I, as a contractor, can circumvent having to sign a BAA, along with the hassle of setting myself up as being HIPAA compliant, and carrying the risk of being directly pursued for a HIPAA breach?