June 3, 2025 Have you ever been stumped by a HIPAA Security Risk Analysis (SRA) question because you didn’t know the answer? Even the most seasoned HIPAA Compliance Officers encounter administrative and technical security questions outside their area of expertise, and that’s completely normal. Remember, you’re not expected to have all the answers. So, how are you supposed to get the right answers for the questions you don’t know from those who do? Abyde’s latest update, SRA Contributor, helps you get the necessary answers. This feature allows you to send questions internally to other Abyde users (at your practice) or externally to trusted contacts of your Business Associates (BAs), allowing you to complete your SRA confidently. The Users section has now been updated to include both Users and Contributors. Once in this section, click the SRA Contributor tab to add external individuals, such as your IT partner, who can assist in answering SRA questions. Then, complete the SRA. We encourage users to mark uncertain questions with ‘Don’t Know’. Once the SRA is complete, Abyde users can access the SRA Contributor feature from their Scorecard module and securely send any questions as needed. Hit the Abyde Flag icon to the right of any question on your Scorecard to activate the SRA Contributor pop-up and select your Contributors. As a reminder, you can add a note to any question for your Contributors. Once flagged, the question(s) are batched and ready to be sent. Abyde recommends reviewing any and all questions for Contributors and sending them in one batch to reduce the number of emails. After all questions are flagged, send them together by hitting the send icon on the Contributor line below the question or from the global SEND button at the top of the Scorecard module. Once sent, your SRA Contributors (and other Abyde users) will receive an email to the secure SRA Contributor Portal. The Contributor Portal includes all flagged questions. Your Contributors can answer your questions, add notes, and send their responses to you once they complete the portal. From there, you will receive an email notification that your question has been answered and is ready for review. Then, you can either reject or approve an SRA Contributor’s answers. If approved, their answer and note (if present) replace your initial response on the SRA. If rejected, you can send the question again to other contributors or manually change the answer yourself. SRA Contributors’ answers and Contributor Portal links (if they never answered the question) can also be deleted from the Scorecard by clicking the Trash Can icon. Why This Matters A thorough and accurate Security Risk Analysis (SRA) is paramount for safeguarding patient data and ensuring compliance. It is the foundation of a compliant practice. The SRA Contributor enables you to complete the SRA more efficiently and confidently, enhancing collaboration with your business associates and other Contributors who manage the more technical aspects of your practice. This ensures that the required SRA is completed accurately and thoroughly, giving you confidence in the integrity and completeness of your answers. To learn more, contact our support team at support@abyde.com, or call 1.877.816.1620.
Ransomware Reality Check: Business Associate Pays Big HIPAA Fine
6/2/2025 Did you know Business Associates (BAs) are at risk for ransomware attacks just as much as Covered Entities? Ransomware attacks disproportionately affect healthcare organizations, with malicious actors looking to exploit Protected Health Information (PHI). When PHI includes sensitive information such as Social Security Numbers, addresses, phone numbers, and more, it provides someone with a lot of information to use for the wrong reasons. A medical billing BA in Massachusetts, Comstar, LLC, recently experienced the fallout of a ransomware attack. Trusted with the PHI of over 70 practices, the organization did not have the proper safeguards to mitigate risk after a cybercrime. Part of this was a missing Security Risk Analysis (SRA), or a thorough assessment of an organization’s potential vulnerabilities. This latest enforcement represents the responsibility of BAs to uphold their commitments and for all HIPAA-regulated entities to complete and maintain an SRA. What Happened? In May 2022, a malicious actor intruded Comstar’s network servers. Comstar was unaware of this intrusion for several days. In the meantime, the hacker encrypted nearly 600,000 patient records with ransomware. Even though these patients weren’t directly Comstar’s, they assumed the responsibility of protecting their data. While it is not public what steps Comstar took to mitigate risks after the initial ransomware breach, it was discovered that the organization did not complete an SRA. This assessment is at the foundation of a compliant practice and is a requirement of HIPAA. After this discovery, the organization was fined $75,000 and put under a Corrective Action Plan (CAP), or government monitoring, for two years. This assessment is at the foundation of a compliant practice and is a requirement of HIPAA. Recently, the Office for Civil Rights (OCR) has sharpened its focus on this commonly missed requirement with the latest Risk Analysis Initiative. This fine is the 9th enforcement of this initiative. Streamlining the SRA with Software When less than 20% of BAs could showcase a compliant SRA when being audited, completing the SRA is unfortunately a common oversight by regulated entities. Additionally, this is a responsibility of both Covered Entities and BAs, and both parties must carefully handle PHI. With smart software, BAs can easily streamline the SRA and complete the assessment that pinpoints common vulnerabilities organizations face. By simplifying the SRA, intelligent solutions can empower an organization to cultivate a culture of compliance for its staff, securely meet requirements, and handle PHI. To learn more about how your organization can easily complete the SRA, meet with a compliance expert today.