Stealth law: HIPAA's back-door regulation of "business associates"

The final HIPAA privacy modifications have substantially lightened the administrative, compliance, and liability loads borne by health plan and provider covered entities. Unlike under the original Clinton rules, for example, covered entities are no longer required to obtain patient consents, to monitor and mitigate the information practices of their business associates, or to treat patients as third-party beneficiaries of their business associate contracts. But the final modifications have done almost nothing to lessen the huge burdens and expense that will soon be imposed on those managed care entities that are merely business associates, a category that Congress never authorized HHS to regulate.