This qualification has been added to accommodate circumstances where terminating the contract would be unreasonably
burdensome on the covered entity, such as when there are no viable alternatives to continuing a contract with that particular business associate.
She also indicated that OCR was beginning to finalize
reports on the covered entity desk audits that they hoped would be shared with those organizations «in the next few weeks» at which point OCR would start the drafting of the reports on the business associate desk audits.
If law firms
take on covered entities as clients that give them access to PHI, attorneys must comply with all the relevant regulations.
This provision is intended to protect the covered entity when a member of its workforce or a business associate discloses protected health information to
whistleblow on the covered entity (or its business associates); it is not intended for disclosures of conduct by the individual who is the subject of the information or third parties.