9

I am currently developing a web-application for a client in the US (I'm from Switzerland). The client's application will handle sensitive data which falls under the "HIPAA Security Rule" (patients information).

I know that I have to implement the requirements, and I will do that as good as I can. But what happens if I deploy the application, and it runs well but lets say after 6 months a hacker is able to access data.

Can I be held responsible for that? What consequences would I have to face? Would it maybe even be required for me to show up physically in a court/investigative office?

I'd be really grateful if someone could answer me this question, I wasn't able to any information on that topic (maybe because it's really hard to understand legal texts in a foreign language...)

Improve this question
5
  • Do you have a contract?
    – Memj
    Jun 9, 2016 at 1:33
  • @Memj not exactly, the job was arranged through Upwork. I have no additional contract.
    – Jonas Wirth
    Jun 9, 2016 at 5:41
  • 2
    I would suggest asking for a contract to be made, or you make one and ask it to be signed. You can simply state (the contract should be more in depth than the following "In the unforeseen event that there is a breach in data I cannot be held responsible for any HIPPA violations". I would include that you are developing it to be as secure as you can make it within your ability and time allowance and that once you hand the product off you and not responsible for any misuse of the product.
    – Memj
    Jun 10, 2016 at 1:37
  • @Memj thanks a lot, I'll set up a contract
    – Jonas Wirth
    Jun 11, 2016 at 9:58
  • I'm moving my comment to an answer so It can be accepted for future readers. Glad I could help.
    – Memj
    Jun 12, 2016 at 0:10

3 Answers 3

Reset to default
6

I would suggest asking for a contract to be made, or you make one and ask it to be signed. The purpose of a contract is to protect both parties.

You can simply state (the contract should be more in depth than the following "In the unforeseen event that there is a breach in data I cannot be held responsible for any HIPPA violations". I would include that you are developing it to be as secure as you can make it within your ability and time allowance and that once you hand the product off you are not responsible for any misuse of the product.

I used to work for a pharmacy and HIPPA violations are VERY serious in the US and am honestly surprised that they did not make you sign a non-disclosure agreement.

Basically, within this contract you:

  • Should not be responsible for the product once it's no longer in your hands
  • Should not be responsible for misuse of the product by the company, it's clients or individuals with malicious intent
  • Should not be sued by a client of the company due to any reason about the product and it's use. If a client of the company wants to create a suit, they should go after the company who is the owner of the product.
  • Should have an agreement as to how you can reflect the work you've done on this project. Can you have your name on the product as the developer? Can you put this project on your resume? Can you reuse the code in the future? Can you develop a similar product for a competing company?

The company:

  • Should receive the developed product that is as secure as your ability allows.
  • Should take full responsibility as to how the product is used internally and externally.
  • Should outline situations in which you may be requested to work on this project again. Is this a one and done deal? Do they expect you to update the product for them in the future? If a new developer can't understand your code can they talk to you? If the product does get hacked are you required to try to patch the security hole?

I would also talk to the company about consulting with a lawyer to create the contract and the company should be the one to pay for the lawyer if that route is taken.

EDIT 1:

Based on a comment by @cdkMoose

You should also look into getting professional liability insurance. You can not entirely contract away your responsibility. If your work fails in some way that should have been caught and creates a security hole you could still be responsible. Contracts won't protect you from something that could be considered professionally negligent.

Improve this answer
3
  • 1
    I have done essentially the same thing when my clients job was subject to USFDA (Food & Drug Administration) work rules and they asked me for a "hold harmless" agreement. I point out that as soon as I write the software, they own it and I have no control over how the use or misuse it, that is they, the manufacturer, who is required to prove the device is safe and effective, and that to expect that I, a sole practitioner, could possibly defend their company against a medical lawsuit is just plain ridiculous. Then I ask them for a hold harmless agreement, and I usually get it!
    – JRobert
    Jun 17, 2016 at 23:40
  • 1
    FWIW, you should have professional liability insurance. You can not entirely contract away your responsibilty. Not saying you aren't a good developer, but, if your work fails in some way that should have been caught and creates a security hole you could still be responsible. Contracts won't protect you from something that could be considered professionally negligent.
    – cdkMoose
    Jun 20, 2016 at 19:23
  • editing your comment into the answer @cdkMoose
    – Memj
    Jun 20, 2016 at 23:00
0

My 2 cents..I had worked for a medical project and gained some knowledge on HIPPA. As a developer you can not guarantee HIPPA implementation at all. HIPPA is a set of rules and procedures where everyone (including developer, server admin, hosting company, product owner and lawyer) need to work jointly in order to establish a secure storage and communication of medical data. Also the compliance will be provided by an attorney and not by a developer. In case anything goes wrong the first responsible person could be client, second the attorney, third the hosting company and then the list can move ahead!

As an another note, the customer must try to understand the cost of servers that provides HIPPA compliance service. Its way beyond one can think of.

Improve this answer
2
  • This seems like a reasonable answer; whoever -1'ed it, owes us some explanation, imho.
    – cnst
    Mar 6, 2017 at 4:46
  • This is a valid comment, I have removed the -1 there are many more items involved in HIPAA compliance than just the code and that reflects on the initial question. You need a HIPAA compliant datacenter, SSLs, encryption, all kinds of good things well beyond the code. This comment is pertinent to the discussion.
    – Entre Preneur
    Mar 30, 2017 at 21:08
0

Are you a licensed Engineer, e.g., a non-software one?

If not, you generally cannot be found liable for unintentional software defects. Just ask Microsoft:

http://www.linuxjournal.com/content/should-software-developers-be-liable-their-code

Should Microsoft pay for the billions of dollars of damage that flaws in its software have caused around the world? It might have to, if a new European Commission consumer protection proposal becomes law.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.