A few months ago, a client called to review a business associate agreement (BAA) they were about to sign with a well-known company whose entire business is providing services to insurance agencies (names have been left out to protect… the other party). Upon review, we discovered there was no indemnification clause in the agreement. Our concern sparked a call between our team, the agency, and the vendor, during which we were informed that the company's board had explicitly forbidden the legal department from offering indemnification in their service agreements with agents – even though they are often the one holding all of the protected health information (PHI) that the agency has on their clients.

Today, when so many agents, brokers, and consultants rely on third parties to support their daily operations, you must understand what your exposure is if your valued business partners fall victim to an event that results in a HIPAA breach.

So, what is an indemnification clause, why is this so important, and why should your group insist on this in your BAAs?