Must Remote Backup Service Providers Comply?
Remote Backup Service Providers are clearly not Covered Entities. Because Remote Backup Services does not involve the use or disclosure of PHI, and any access to PHI by a Remote Backup Service Provider would be incidental, if even possible, Remote Backup Service Providers are not normally considered to be Business Associates, and are therefore not covered by the HIPAA Privacy Rule. However, some Covered Entities may wish to have a Business Associate Contract in place regardless. How this is handled is up to the individual Remote Backup Service Provider. Remote Backup Services do clearly fall within the requirements of the HIPAA Security Rule. Covered Entities must be compliant with the Security Rule by April 21, 2005. Remote Backup software and services are compliant today, and can provide a foundation for overall compliance.
