Ignorance of HIPAA is no defense against the imposition of a civil penalty or any other type of action by HHS. However, prior to disclosing PHI to a business associate, covered entities are required to conduct due diligence on the business associate to ensure the mechanisms exist for compliance with HIPAA. If a covered entity fails to conduct due diligence prior to disclosing PHI or fails to sign a Business Associate Agreement stating the permissible uses and disclosures of PHI, the covered entity may be jointly liable for any subsequent violation of HIPAA.