Since the publication of the Final Omnibus Rule in 2013, service providers operating as Business Associates have been directly liable for compliance with certain Privacy Rule and Security Rule requirements. Therefore, even though Business Associates are required to report all security incidents to the Covered Entity they are providing a service to, if it transpires that a data breach was attributable to the Business Associate’s failure to comply with the Privacy Rule and Security Rule requirements, the Business Associate – rather than the Covered Entity – will be considered liable.