A medical billing software vendor offers a Business Associate Agreement (BAA) that limits liability to $10,000. What risk management concern should this raise for a large medical group?
-
A
The cap may be insufficient to cover breach costs averaging $200K+
-
B
BAAs are optional under HIPAA so the cap is irrelevant
-
C
The vendor should not offer any BAA at all
-
D
Liability caps are required by HIPAA regulations