The Department of Health and Human Services Office for Civil Rights Friday issued a factsheet on HIPAA requirements for business associates under the Health Information Technology for Economic and Clinical Health Act of 2009. “As part of the Department’s effort to fully protect patients’ health information and their rights under HIPAA, OCR has issued this important new factsheet clearly explaining a business associate’s liability,” said OCR Director Roger Severino. “We want to make it as easy as possible for regulated entities to understand, and comply with, their obligations under the law.”