|
Hey CPers,
I have a possible upcoming contract doing some medical billing development which is obviously going to involve some pretty serious HIPAA regulation territory. I've been a 1099 independent contractor before but never in an area which is so legally sensitive and security-centric.
Does anyone have any experience to share as to whether or not, as the sole developer on this project, I need to worry about purchasing some kind of insurance or bonding just for CYA purposes, or does the legal wording that I put in the agreement in regards to no warranty implied on my part, not responsible for anything whatsoever from someone using my software, etc., suffice as far as protection from litigation from God knows who all - from the feds at HIPAA on down to the end client?
Thanks Everyone!
"... having only that moment finished a vigorous game of Wiff-Waff and eaten a tartiflet." - Henry Minute
"Let's face it, after Monday and Tuesday, even the calendar says WTF!" - gavindon
Programming is a race between programmers trying to build bigger and better idiot proof programs, and the universe trying to build bigger and better idiots, so far... the universe is winning. - gavindon
|
|
|
|
|
Seems to me that asking a lawyer that deals with those kinds of legal issues would be better.
You can lead a developer to CodeProject, but you can't make them think.
The Theory of Gravity was invented for the sole purpose of distracting you from investigating the scientific fact that the Earth sucks.
|
|
|
|
|
Quote: Seems to me that asking a lawyer that deals with those kinds of legal issues would be better.
Seems to me that you are correct sir, as I already am waiting on a call-back from the best one I know....
However being that in the past 8 years of being a CPer I have shared and read many good professional stories and experiences in this usually quite helpful Lounge community, none of which would I have been enough of an idiot to take as board-certified legally-binding truths carved out of the same tree that the Declaration of Independence was milled from...
So at the risk of sounding like Captain Obvious, thanks for at least replying, Captain Obvious! Cheers 
"... having only that moment finished a vigorous game of Wiff-Waff and eaten a tartiflet." - Henry Minute
"Let's face it, after Monday and Tuesday, even the calendar says WTF!" - gavindon
Programming is a race between programmers trying to build bigger and better idiot proof programs, and the universe trying to build bigger and better idiots, so far... the universe is winning. - gavindon
|
|
|
|
|
Turns out that all I needed to ask was the CPians plus one non-CPian  firmware dude I know and I got a treasure trove of much-appreciated advice and well-wishings...
Still waiting on that callback from my lawyer FFS... LOL Although I'm still going to talk to him so thanks for your post Wes!
Cheers
"... having only that moment finished a vigorous game of Wiff-Waff and eaten a tartiflet." - Henry Minute
"Let's face it, after Monday and Tuesday, even the calendar says WTF!" - gavindon
Programming is a race between programmers trying to build bigger and better idiot proof programs, and the universe trying to build bigger and better idiots, so far... the universe is winning. - gavindon
|
|
|
|
|
I think the "find a lawyer" advice is the best you will get. That is if the rules have been finalized and anyone can understand them.
I worked in the medical industry when the ACA passed and added some extra rules and regulations to HIPAA, including some language which allowed hospitals to go after individual developers instead of just the company they worked for if security breaches occur. That and the language involving jail time for high levels of negligence.
I've never heard of insurance or bonding for software development. I would consider starting a company that does so, but given my experience as a developer and working with developers, there will always be a bug that could potentially lead to data breaches. If giant companies like Google, Microsoft, and Apple can't get it right what chance do you have?
|
|
|
|
|
|
clientSurfer wrote: Unless I just make sure to not include any bugs
Write it into your contract that if any bugs are found, you get paid double for each one you wrote. See if they catch it.
You can lead a developer to CodeProject, but you can't make them think.
The Theory of Gravity was invented for the sole purpose of distracting you from investigating the scientific fact that the Earth sucks.
|
|
|
|
|
Wes Aday wrote: Write it into your contract that if any bugs are found, you get paid double for each one you wrote. See if they catch it.
 heheh! Now yer talkin turkey, lurkey! That's funny like f^ck
"... having only that moment finished a vigorous game of Wiff-Waff and eaten a tartiflet." - Henry Minute
"Let's face it, after Monday and Tuesday, even the calendar says WTF!" - gavindon
Programming is a race between programmers trying to build bigger and better idiot proof programs, and the universe trying to build bigger and better idiots, so far... the universe is winning. - gavindon
|
|
|
|
|
Insurance is a regular requirement down here in NZ. I carry a $1million general cover that includes protection against damage to client's property as well as covering accidental disclosure of corporate secrets or privacy data. At $100 per year, it's quite a bargain. (I had to pay to replace a client's laptop after I broke ths screen -- my cost, $100 deductable -- must remember to place USB cap in pocket next time.)
The difficult may take time, the impossible a little longer.
|
|
|
|
|
 doh! Why the F don't they attach those USB caps with little tethers or something... LOL
Member 10707677 wrote: At $100 per year, it's quite a bargain.
Wow that actually is quite a bargain esp if it is a regular requirement down under... Thanks for the post
"... having only that moment finished a vigorous game of Wiff-Waff and eaten a tartiflet." - Henry Minute
"Let's face it, after Monday and Tuesday, even the calendar says WTF!" - gavindon
Programming is a race between programmers trying to build bigger and better idiot proof programs, and the universe trying to build bigger and better idiots, so far... the universe is winning. - gavindon
|
|
|
|
|
I hold an errors and omissions / professional liability policy with Hiscox insurance, and it's quite reasonable (I'm in the USA). I purchased it so that I could handle systems maintenance for a company which is subject to HIPAA, due to the rather extreme penalties and processes involved in a HIPAA violation, as have been alluded to.
If the price is right, consider it a protection to have just in case. All it takes is one nut to sue you and now you've been dragged into the legal system and your fate (and assets) rests in another's hands.
So, if it's cheap and there's any question, I'd get it. Hiscox allows you to pay monthly, it's effective immediately, and you can get it all set up online.
That's my $0.02.
|
|
|
|
|
Fortunately I don't deal with HIPAA anymore, but I'm glad to see it is available.
I'm curious how likely they are to pay out should you need it or if they will fight it. The fact that it is a value based upon the level of negligence and then multiply that by the number of records access in the breach, it adds up in a hurry.
Edit: I'm glad to see they added an annual max penalty to the language. The draft language had none of that.
|
|
|
|
|
Thanks man, E and O was the first thing my firmware buddy told me about... I will indeed look into Hiscox... Appreciate your $0.02 luke
"... having only that moment finished a vigorous game of Wiff-Waff and eaten a tartiflet." - Henry Minute
"Let's face it, after Monday and Tuesday, even the calendar says WTF!" - gavindon
Programming is a race between programmers trying to build bigger and better idiot proof programs, and the universe trying to build bigger and better idiots, so far... the universe is winning. - gavindon
|
|
|
|
|
I worked in the medical industry when the ACA Not So Affordable Care Act passed and added some extra rules and regulations to HIPAA, including some language which allowed hospitals to go after individual developers instead of just the company they worked for if security breaches occur. That and the language involving jail time for high levels of negligence.
Priceless, unless the fed's lose the data. Still looking for those emails....
Charlie Gilley
<italic>Stuck in a dysfunctional matrix from which I must escape...
"Where liberty dwells, there is my country." B. Franklin, 1783
“They who can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety.” BF, 1759
|
|
|
|
|
charlieg wrote: including some language which allowed hospitals to go after individual developers instead of just the company they worked for if security breaches occur. That and the language involving jail time for high levels of negligence.
heheh gawd that's scary... Hopefully it won't come to that charleg; thanks for responding...
"... having only that moment finished a vigorous game of Wiff-Waff and eaten a tartiflet." - Henry Minute
"Let's face it, after Monday and Tuesday, even the calendar says WTF!" - gavindon
Programming is a race between programmers trying to build bigger and better idiot proof programs, and the universe trying to build bigger and better idiots, so far... the universe is winning. - gavindon
|
|
|
|
|
I suspect everyone will jump on board the "call a lawyer" train. In my experience a lawyer is just going to send you on the path of least resistance - ie. "yes you should buy insurance". It's a liability for them to have a legal opinion that tells you not to buy insurance. Consider what happens if you get sued and you have a legal opinion from your lawyer saying that you didn't need insurance? You'd then be in a position to sue them. So you may want to just save on your legal expenses and apply it directly to the insurance.
I think the bigger question may be "what type of insurance do you need" and "how much". The problem with asking a lawyer about that is that (for most of them) 1) this isn't their area of expertise and 2) see paragraph number one (they'll likely recommend complete coverage at high amounts).
My advice - call around to multiple insurance providers to get their opinions on what you need. Yes, they're going to try to sell you on more insurance than you likely need, but if you call multiple providers you also have the opportunity to compare and contrast. Some will come in with a lower quote because they don't believe you need options that others are insisting on. Get the reasons for the recommendations and then proceed from there.
One final tip - if you are the sole developer this obviously puts you at more risk. However, this also likely means that there are bigger fish involved with this project. In the case of lawsuits most companies will go after the biggest fish (at least that's what our insurance provider told us) because they have the bigger policy. If the odds of you being targeted is lower because there is one or more bigger fish then your premiums should be less.
Best of luck. I'd personally be interested in a follow-up to see how you made out.
Cheers
|
|
|
|
|
Lawyers will never tell you what you can do, only what you should not; which often conflicts with the reality of running a business and making a living.
|
|
|
|
|
Wow thanks man that's a treasure trove right there... Just what I was looking for from this group...
The sad truth of this story is that these guys are kinda jerking me around a bit; looks like the CFO had this as a pet project but now he might not even be the CFO anymore and so now I'm talking to the CEO about what is actually going on over there...
I will update you on my progress with actually getting/not getting this contact and what the implications might be for a product that they basically handed me functional requirements for that, should I decide to do so, could actually be marketable...
Stay tuned and thanks for the good advice that is valuable for all of us in this business!
Cheers
"... having only that moment finished a vigorous game of Wiff-Waff and eaten a tartiflet." - Henry Minute
"Let's face it, after Monday and Tuesday, even the calendar says WTF!" - gavindon
Programming is a race between programmers trying to build bigger and better idiot proof programs, and the universe trying to build bigger and better idiots, so far... the universe is winning. - gavindon
|
|
|
|
|
I've carried $1M (USD) general liability as a 1099 contractor for years -- not that expensive (<$50/month) and either required by contracts or some peace of mind. My policy required me to answer extensive questions about the type of development once I mentioned healthcare/patient data -- thankfully, I was able to answer no to every question related to "Will someone die if your software doesn't work?".
I think an E&O (Errors and Omissions) rider (again, IANAL) might help to limit your penalties/fines.
I use Harford; based on other replies, I'm looking into Hiscox.
HTH.
--G
|
|
|
|
|
I'm insured by Lloyd' of London through a Toronto broker. I have CAD 5,000,000 liability and 100,000 E&O. The liability also includes things like fire coverage for the building I rent. I think I pay about 1500 per year. 5M is a standard requirement for many government contracts. If I want 1M E&O it would as about $1000.
|
|
|
|
|
Thanks Yvan I appreciate the feedback
"... having only that moment finished a vigorous game of Wiff-Waff and eaten a tartiflet." - Henry Minute
"Let's face it, after Monday and Tuesday, even the calendar says WTF!" - gavindon
Programming is a race between programmers trying to build bigger and better idiot proof programs, and the universe trying to build bigger and better idiots, so far... the universe is winning. - gavindon
|
|
|
|
|
Thanks Glenn, I really appreciate your post and your advice... E & O seems to be a common denominator in the replies I've received... Cheers
"... having only that moment finished a vigorous game of Wiff-Waff and eaten a tartiflet." - Henry Minute
"Let's face it, after Monday and Tuesday, even the calendar says WTF!" - gavindon
Programming is a race between programmers trying to build bigger and better idiot proof programs, and the universe trying to build bigger and better idiots, so far... the universe is winning. - gavindon
|
|
|
|
|
I think your biggest concern may be data. If you download/store any data on your computers that contains sensitive information and that data gets out, you are really in trouble. Best advice, don't download any live data.
I had a friend that stored a backup of a customers data on a USB drive, the same one with his music, and he lost it. THAT cost not only money, but the customer as well. We still don't know if that will surface in the future.
A good umbrella policy is always a good idea...
Don't mind me, I'm just watching
|
|
|
|
|
Wow OK ya, this particular project wouldn't particularly be storing any data about patients/providers so much as it would be meta-data about those who are handling it...
Good advice that I'm taking to heart, thanks so much
"... having only that moment finished a vigorous game of Wiff-Waff and eaten a tartiflet." - Henry Minute
"Let's face it, after Monday and Tuesday, even the calendar says WTF!" - gavindon
Programming is a race between programmers trying to build bigger and better idiot proof programs, and the universe trying to build bigger and better idiots, so far... the universe is winning. - gavindon
|
|
|
|
|
I would (if you haven't already) form an LLC to protect you and your assets. It's cheap, really. And just acts as a pass through for your work.
Then have the LLC buy General Liability insurance, and possibly Professional Liability insurance. General covers things like spilling your coffee in the client's new laptop, professional liability would cover program errors etc.
I carry both. It sucks, but so does buying auto insurance and health insurance.
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
