Disclaimer: The following is not legal
advice. Please review the following informational material
with a licensed attorney.
Who owns your data?
Given today's litigious and
legislative environment, this is not a insignificant question.
BAA language directly
addresses the scope of data ownership questions. There are
two standard BAA boilerplates:
- Software as a service (SaaS) and
- Application Host Provider (AHP).
A cogent summary of the legal ramifications are as follows:
CMS Submission process with standard SaaS BAA: You can easily
also lose ownership and control of your clinical data; the
common SaaS (software as a service) BAA used by other vendors
makes data hostage situations more likely under many
situations, including legal depositions and CMS data access
requirements.
CMS Submission process with
AHP BAA
Your
organization retains ownership and control of your clinical data;
our AHP (Application Host Provider) BAA eliminates data hostage
situations, wherein you have full control over situations such
as legal depositions and CMS data access requirements.
QCDR-HISP.ORG
provides your organization with
legal protection from legal exposure by using the AHP BAA.
More information on "Who owns
data?" can be found
here