Fines

Ambry Phishing Settlement
Abyde News, Fines, HIPAA

$700K HIPAA Settlement: What the Ambry Genetics Phishing Breach Teaches Every Practice

September 21, 2026 No comments yet

September 21, 2026   The HHS Office for Civil Rights (OCR) has announced its biggest HIPAA settlement of the year, reaching nearly a million dollars.  Ambry, a genetic testing and clinical genomics provider based in Aliso Viejo, California is at the center of this enforcement. A settlement was reached over a 2020 phishing attack that exposed the Protected Health Information (PHI) of more than 225,000 individuals. This settlement is a clear reminder that even large organizations trip up on HIPAA requirements.    What happened In January 2020, an employee email account at Ambry was compromised through a phishing attack.  The breach potentially exposed a wide range of PHI, including names, addresses, dates of birth, Social Security Numbers, financial details, and more. Ambry reported the breach to OCR in March 2020, which kicked off the investigation.    Where OCR found gaps OCR’s investigation identified several HIPAA Security Rule gaps, including: No accurate, thorough risk analysis of risks and vulnerabilities to ePHI No process for cutting off access to ePHI when an employee left or no longer needed access No unique user IDs for tracking who was accessing ePHI systems These are baseline HIPAA requirements that every Covered Entity and Business Associate is expected to have in place.   The settlement terms Ambry paid $700,000 and agreed to a two-year corrective action plan, under which it must: Complete a thorough risk analysis of ePHI confidentiality, integrity, and availability Build and execute a risk management plan addressing what that analysis turns up Review and update Security Rule policies and procedures as needed Implement unique user identification across all ePHI systems Train the whole workforce on those updated policies The takeaway for practices When 90% of healthcare hacks start with a successful phishing attempt, it’s key your team is aware of the role they play to keep data safe. Every practice should ask; Do we know exactly where our ePHI lives and how it moves through our systems? Do we have a current, documented risk analysis? Would we catch it fast if a former employee’s access wasn’t revoked? Looking for the first step of addressing these gaps? Meet with one of our compliance experts to see where you currently stand. 

Azul Vision Right of Access
Abyde News, Fines, HIPAA

Right of Access Enforcement Hits Eye Care: Inside the Azul Vision Settlement

September 1, 2026 No comments yet

September 1, 2026   The Office for Civil Rights (OCR) announced its 55th settlement under the HIPAA Right of Access Initiative, and this one is a good reminder that “we’ll get to it” is an easy shortcut to a massive financial penalty.   What happened Azul Vision, Inc., a California optometry enterprise healthcare provider, took nearly two years to provide a patient her healthcare records failed to give a patient timely access to her health records. She requested her records in January 2023. She didn’t actually receive them until January 2025, or two years later, and only after OCR opened an investigation following her complaint in April 2023.   The importance of Right of Access The HIPAA Privacy Rule’s Right of Access is straightforward: patients are entitled to their healthcare records within 30 days of a request, with one possible 30-day extension if needed.    The cost Azul Vision agreed to a two-year, OCR-monitored corrective action plan and paid $50,000. The corrective action plan requires the practice to: Review and revise its written policies and procedures for Privacy Rule compliance.  Regularly report to HHS a log of every PHI access request it receives, including when it came in and when it was resolved, Train all workforce members on right of access requirements and the practice’s own procedures.   Practical takeaways Have a documented, assigned process for access requests: not an informal “someone will handle it” arrangement. Track every request against the 30-day (or extended 60-day) clock: If nothing is timestamping requests, nothing is catching the ones that slip. Train staff specifically on right of access: this is a distinct Privacy Rule obligation from general HIPAA awareness, and it’s clearly one OCR is actively enforcing.   The bottom line A single records request that went unanswered turned into a $50,000 penalty, two years of federal monitoring, and a detrimental hit to the organization’s reputation. That’s a steep price for what really comes down to a missing process. If your team can’t answer “what happens the moment a patient asks for their records?” right now, that’s the gap to close before your practice ends up as OCR’s next enforcement case. Want a streamlined way to close your compliance gaps? Meet with an Abyde expert today!

OSF Healthcare HIPAA Settlement
Abyde News, Fines, HIPAA

What OSF Healthcare’s Ransomware Fine Teaches Every Practice About SRAs

August 5, 2026 No comments yet

August 5, 2026 The latest HIPAA fine is another clear reminder that ransomware attacks are, unfortunately, here to stay in the healthcare industry. A settlement involving the OSF Healthcare System was recently announced by the Office for Civil Rights (OCR). As an enterprise healthcare provider in the midwest, the organization serves 174 locations, including 16 hospitals – a prime target for a ransomware attack.    So, what happened?  In April 2021, OSF discovered that they joined the unlucky club of ransomware victims when a malicious actor deployed Nephilim, a ransomware strain made to target larger organizations. Once the ransomware infected OSF systems, the hacker demanded payment or patient Protected Health Information (PHI) would be leaked online. In this attack, sensitive information like financial account information, driver’s license numbers, medical record numbers, and more, were all exposed. Over 53,000 patient records were exposed in this attack.  When ransomware attacks in healthcare have soared 278% in recent years, it’s more of a when then an if your organization doesn’t have the right safeguards in place.  While the breach was discovered in April, OSF healthcare reported the breach to the OCR in October. The OCR took it from there, digging into what precautions (or lack thereof) let this happen.  What did the OCR discover? If you’ve read any of our other fine breakdowns, you already know where this is going: another missing Security Risk Analysis (SRA).  The SRA is a required document every HIPAA-regulated entity (ie: every practice and their Business Associates that handle patient information) needs to complete. The SRA is a thorough review of the physical, technical, and administrative safeguards in place to prevent PHI ending up in the wrong hands. While the OCR didn’t specify exactly how the ransomware got into OSF’s system, a technical safeguard vulnerability was very likely the entry point. A proactive SRA could have flagged that gap before it turned into a major breach. In addition to missing this required documentation, OSF also took too long to report the breach to the OCR and notify affected patients. This is a direct violation of the Breach Notification Rule, which requires organizations to notify patients within 60 days of a discovered breach. Moreover, since the breach impacted more than 500 patients, OSF was also required to report this breach to the OCR within 2 months as well. Time is of the essence in every component of a breach, from securing systems to ensuring affected parties are aware to protect themselves and an over five month delay was unacceptable in the eyes of the OCR.    What was the result?  OSF’s settlement tops the list as the largest fine of the year, coming in at $552,250, plus government monitoring for the next two years.  It’s very important to note that this breach occurred in 2021, meaning that over five years were spent from the initial breach, to investigations, to the public press releases. Also, the average cost of a healthcare breach is over 7 million dollars –  from implementing secure systems, notifying patients, legal fees, and more. The Takeaway While the settlement payment and Corrective Action Plan (CAP) are just the cherries on top, this experience was a tremendous cost of time, money, and resources, highlighting the importance of making sure everything is secure before a situation occurs.  So, when was the last time you looked at your SRA? It’s time to seriously analyze your current compliance posture. Ransomware groups don’t check whether you’re a small dental office or a 16-hospital health system before they attack, they check whether the door was left open. Time and again, OCR’s findings come back to the same root cause: organizations can’t secure what they haven’t even identified as a problem. Looking to review your current compliance standings? Meet with our team of experts for a complimentary educational consultation. 

Spencer Gifts HIPAA Fine
Abyde News, Fines, HIPAA

Spencer Gifts HIPAA Settlement: Ransomware, Risk Analysis, and What Comes Next

June 19, 2026 No comments yet

June 19, 2026   Quick Guide:  The Office for Civil Rights issued a major fine towards Spencer Gifts benefits plan. This fine reinforces that all HIPAA-regulated entities must have a thorough compliance program.    The Stats You Need to Know 76%: The percentage of large healthcare breaches now caused by hacking/IT incidents. $450,000: Financial settlement of this enforcement. 10,023: The number of individuals were impacted in this breach.  264%: The increase in ransomware-related breaches reported to the OCR since 2018.   When you think about Spencer’s, you likely picture the staple mall store with pop culture novelty gifts, not the latest HIPAA settlement enforcement headline.  Spencer Gifts LLC Flexible Benefits and Welfare Benefit Plans, or their employee benefits plan, reached a settlement with the Office for Civil Rights for $450,000 and a 2 year Corrective Action Plan (CAP).  This fine is a reminder that Covered Entities include all parties that create and utilize patient data, including health care plans. While they might not see patients traditionally, they still are responsible for keeping Protected Health Information (PHI) secure.    What Happened?   In response to employee complaints regarding access to their employee benefits portal, Spencer Gifts Health Plan discovered their systems were infiltrated with ransomware in November 2021. Malicious actors encrypted over 10,000 individuals’ PHI and demanded a ransom. The exposed data included names, phone numbers, social security numbers, and more, putting employees at risk.  The breach was reported in January 2022. After years of investigation, it was settled that the plan failed to meet basic HIPAA Security Rule requirements proactively.    The Compliance Gaps A common misconception is that an organization faces a financial penalty due to a breach. While the breach serves as the catalyst for the investigation, the OCR is looking to see if an organization has a thorough compliance program in place and made a genuine effort to protect patient data.  For instance, the health plan did not complete a Security Risk Analysis (SRA). This required assessment identifies all technical, administrative, and physical safeguards (and vulnerabilities) across your organization. By completing this document, your organization can address concerns before they become an issue. There’s no way to know where risks are unless they are properly reviewed.  Additionally, the plan did not have sufficient policies and procedures, nor trained staff adequately. Without sufficient policies and training, staff are left without the tools to recognize and respond to HIPAA threats before they escalate. As a result, Spencer Gifts now faces $450,000 in penalties and two years of government monitoring to ensure those missing requirements are finally implemented. And that figure doesn’t account for the years of investigation, legal fees, breach notification costs, and operational disruption that preceded the settlement.   The Biggest Takeaway This case isn’t only a lesson for retail organizations’ health plans, but it’s a warning for every HIPAA-regulated entity. The OCR can and will investigate any organization exposed for failing to meet HIPAA requirements, including small medical practices To be prepared before a cyberattack occurs, make sure your organization has: A completed and current Security Risk Analysis. A trained workforce that knows how to handle PHI Accessible policies and procedures staff can actually reference. An up-to-date compliance program.  Ready to strengthen your compliance program? Schedule a free educational consultation with our team today.

OCR Ransomware Settlements
Abyde News, Fines, HIPAA

OCR Ransomware Settlements: 4 Massive HIPAA Fines from April 2026 & How to Avoid Them

May 4, 2026 No comments yet

May 4, 2026   Quick Guide:  The Office for Civil Rights (OCR) just issued a massive wake-up call, announcing four simultaneous settlements totaling $1,165,000. The Stats You Need to Know 76%: The percentage of large healthcare breaches now caused by hacking/IT incidents. 427,000+: Total number of patients impacted across these four recent settlements. 264%: The increase in ransomware-related breaches reported to the OCR since 2018. The Office for Civil Rights (OCR) just announced a flurry of investigation settlements. At the root of the four that were announced: ransomware. Ransomware attacks continue to target healthcare facilities. As of last year, the OCR discovered that 76% of large breaches are due to hacking and IT shortcomings. Unfortunately, healthcare information is a goldmine for hackers, exposing sensitive data that can lead to identity theft, financial fraud, and compromised patient care. Breakdown & Lessons Learned Regional Women’s Health Group (Axia) The first settlement was regarding the Regional Women’s Health Group (Axia), an OBGYN network across five states. In this case, the organization submitted a breach report following a cyberattack that exposed over 37,000 patients. The settlement resulted in a $320,000 fine and a 2-year Corrective Action Plan (CAP). The Lesson: The OCR didn’t just fine them for being hacked; they reached a settlement because the healthcare organization failed to conduct a “thorough and accurate” Security Risk Analysis (SRA). If you don’t know where your vulnerabilities are, you can’t patch them. Unfortunately, hackers counted on this negligence and exploited it.  Assured Imaging This was the largest of the four fines, affecting a staggering 244,813 individuals. When a ransomware infection hit their servers, Assured Imaging, a medical imaging enterprise, reported a breach to the OCR. After a long investigation (the initial cyberattack occurred in 2020), and resulted in a $375,000 settlement and a 2-year CAP.  The Lesson: Beyond the initial ransomware attack, it was discovered that Assured had never completed an SRA. Additionally, the organization did not notify patients within 60 days of discovery of the breach. This is a direct violation of the Breach Notification Rule, which aims to allow patients to take control and mitigate risks as quickly as possible.  Consociate Health Consciate Health is the only Business Associate (BA) fine in the four. BAs continue to be under the OCR’s microscope, such as potentially needing to follow stricter requirements when handling patient data. Their breach started with a phishing attack that eventually led to the encryption of systems holding data for over 136,000 people. The BA discovered the ransomware six months after the initial phishing attack. Upon the OCR’s further investigation, the SRA was found to be insufficient. The organization paid a $225,000 settlement and entered into a 2-year CAP.  The Lesson: Human error (phishing) is the most common entry point for ransomware. Constant employee training is just as important as a strong firewall. Additionally, just because a BA doesn’t directly work with patients doesn’t mean it isn’t their responsibility to keep patient data secure.  SG Health Plan Even employee benefit plans are regulated under the Health Insurance Portability and Accountability Act (HIPAA). SG Health Plan, associated with a Connecticut energy provider, reported that the data of 9,316 members were exposed following a ransomware attack. It was discovered that the organization did not complete an extensive SRA. The benefit plan entered a settlement with the OCR for $245,000 and a 2-year CAP.  The Lesson: This settlement highlights that HIPAA applies to corporate health plans just as much as it does to traditional healthcare providers. Additionally, every organization that handles Protected Health Information (PHI) must complete an SRA.  The Bottom Line The OCR isn’t fining practices for ransomware attacks, but for being ill-prepared.  However, it is easier said than done to ensure your organization is secure in protecting patient data and complying with HIPAA.  Proactively implementing the HIPAA Security Rule is your opportunity to mitigate the impacts of a cyberattack. Waiting until the ransom note appears on your screen is a million-dollar mistake. Want to see what you might be missing?  Run a 5-Minute HIPAA Gap Assessment and protect your practice today! 

MMG Fusion HIPAA Settlement
Abyde News, Fines, HIPAA

15 Million Reasons to Review Your Business Associates: Lessons from the MMG Fusion Settlement

March 6, 2026 No comments yet

March 6, 2026 They say a mistake ignored is a disaster in the making. For one dental software provider, a 2020 breach became a 15-million-patient nightmare in 2026. MMG Fusion LLC, a dental marketing software business in Maryland, is in the crosshairs of the OCR and the subject of the latest HIPAA enforcement action. MMG agreed to a $10,000 settlement and a 3-year Corrective Action Plan (CAP).  The latest HIPAA settlement, and the 12th Enforcement Action in the Office for Civil Rights (OCR) Risk Analysis Initiative, highlighted the importance of completing a thorough Security Risk Analysis (SRA), proper Breach Notification, and choosing the right Business Associate (BA).  What Happened?  In December 2020, a malicious actor infiltrated MMG’s systems. Over 15 million patients’ Protected Health Information (PHI) was exposed in the cybercrime and leaked to the dark web.  Under the HIPAA Breach Notification Rule, a BA must notify affected Covered Entities (the dental practices) within 60 days of discovering a breach. However, the OCR didn’t learn about this 2020 incident until a complaint was filed in March 2023, more than two years later. The investigation uncovered a critical flaw: MMG Fusion lacked a compliant Security Risk Analysis (SRA). The SRA is a comprehensive review of an organization’s physical, technical, and administrative safeguards to protect PHI. A thorough SRA likely would have identified the very system vulnerabilities that the hackers exploited in 2020. Although the OCR factored in MMG’s “small business” status when determining the $10,000 fine, this amount does not account for the years the investigation took, the accumulated costs of legal counsel, stress, and reputational damage that occurred before the fine was made public. Additionally, MMG will also need to report to the OCR for 3 years in accordance with the CAP settlement.  Streamline Your Compliance This case highlights three non-negotiable pillars for every HIPAA-regulated entity: compliant HIPAA risk assessments, timely breach notification to the OCR and impacted parties, and choosing the right business partner to handle your sensitive information.  Managing vendors and staying on top of SRAs is overwhelming for a busy healthcare organization.  Modern software solutions automate the SRA process and generate compliant Business Associate Agreements (BAAs) for Covered Entities and BAs to use, ensuring both parties are held accountable.  Ready to learn more? Meet with an expert today!

Top of the World Ranch Treatment Center HIPAA Settlement
Abyde News, Fines, HIPAA

2026 HIPAA Compliance Alert: $103,000 Settlement for Risk Analysis Failure

February 23, 2026 No comments yet

February 23, 2026   The Office for Civil Rights (OCR) is back with a massive settlement to start 2026.  A rehab center in Illinois, Top of the World Ranch Treatment Center (TWRTC), recently agreed to a $103,000 and 2-year Corrective Action Plan (CAP) settlement following a security breach that exposed major security vulnerabilities. This settlement is also the 11th enforcement of the Risk Analysis Initiative.  The Top of the World Ranch Treatment Center HIPAA settlement was announced just days after the OCR officially enacted the Part 2 changes to the Notice of Privacy Practices. As of Feb 16, all Covered Entities, regardless of scope of practice, must update their Notices of Privacy Practices (NPP) to include special provisions regarding the handling of Substance Use Disorder (SUD) Protected Health Information (PHI).    What Happened?  In March 2023, an employee’s email account was compromised in a phishing attack, exposing fewer than 2,000 records. In the world of healthcare data breaches, where numbers often reach the millions, this was a relatively small but still severe incident. However, the OCR’s enforcement was not based on the size of the breach, but on missing paperwork. This breach report initiated an investigation that led the OCR to find the SUD facility had failed to complete a compliant Security Risk Analysis (SRA). The SRA is the foundation of a HIPAA-compliant practice and an extensive assessment of the potential vulnerabilities your practice might face. The SRA reviews the administrative, physical, and technical safeguards your practice must have in place.  Since TWRTC hadn’t completed this proactive assessment, they missed the specific vulnerabilities in their technical defenses that eventually allowed a phishing email to succeed.   The Bottom Line The Top of the World Ranch Treatment Center HIPAA settlement proves that the OCR doesn’t punish based on how ‘big’ a mistake is, but for a lack of preparation. Breaches happen, but your team’s readiness and response are what determine whether you face an enforcement action. You might think your practice is too small to be a target, but this settlement shows that if you have a breach, no matter the size, the first thing the OCR will ask for is your SRA. If you don’t have it, the legal repercussions could be far more painful than the breach itself. Is your SRA current for 2026? If not, meet with our team of experts today to get compliant.

Abyde News, Fines, HIPAA

One Patient Request, Years of Fallout: The Concentra Right of Access Case

December 22, 2025 No comments yet

December 22, 2025 Well, the Office for Civil Rights (OCR) is back, folks!  After a historic government shutdown, the OCR has announced its first fine.  The recipient of the latest fine is Concentra, Inc., a Texas-based enterprise healthcare provider. While this health organization might have numerous locations, the root of this federal fine and years of legal battles stems from one patient complaint to the OCR.  With the 21st fine of the year, we’re taking it back to the basics: Patient Right of Access.  What Happened?  In February 2018, a patient requested a copy of their medical and billing records from Concentra’s Peoria, Arizona, location. While a Concentra employee forwarded the request to the billing office, the patient did not receive their medical records in a timely manner. The patient sent several requests throughout the year.  In October 2018, Concentra’s Business Associate issued an invoice to the patient for $82.57 for the requested medical records. This amount was disputed.  After months of back-and-forth with Concentra, in December 2018, the patient filed a complaint with the OCR regarding how the healthcare provider handled their record request. Finally, in March 2019, over a year after the initial request, Concentra’s Business Associate provided the health records to the patient for an adjusted rate of $6.50.  Providing the records was just the beginning for Concentra. In the summer of 2020, the OCR notified the healthcare provider that this case indicated noncompliance with the Privacy Rule and provided Concentra with the opportunity to submit mitigating evidence.  Then, in 2021, the OCR proposed to levy a $250,000 penalty. After several more years of legal battles, the OCR settled this case in 2025 with a $112,500 settlement.  Patient Right of Access 101 This lengthy chain of events highlights the importance of promptly and thoroughly addressing patient requests.  Detailed in the Privacy Rule, patients have the right to access their health records within 30 days from the initial request, known as the Right of Access. This timely access empowers patients to make informed decisions about their healthcare. This 30-day timeline applies on the federal level. Depending on the state, your practice may be required to comply with more stringent timelines, as seen in California.  The 30-day timeline is firm, and a practice can only be granted an extension once, for an additional 30 days. In addition to adhering to a 30-day timeline, the fees for copies of records must be reasonable and feasible.  The acceptable fee for providing copies of documents is limited to the cost of labor for copying, supplies, postage, and any provided summary. Alternatively, your practice can charge a flat fee of not more than $6.50 instead of calculating these specific costs.   Keeping Your Practice Compliant (And Your Patients Happy) While following the Right of Access might seem straightforward, it’s one of the most common HIPAA violations practices make. There have been 50+ HIPAA Right of Access enforcement actions levied by the OCR.  With the right compliance program, you can ensure that your staff is aware of all requirements when handling patient requests. Clear policies and engaging training help you respond correctly, on time, and with confidence. Ready to ensure your practice is HIPAA compliant? Schedule a consultation with one of our compliance experts today.

Cadia Healthcare HIPAA Fine
Abyde News, Fines, HIPAA

From Success Stories to HIPAA Violations: Cadia Healthcare’s $182K Lesson

October 6, 2025 No comments yet

October 6, 2025   Remember: sometimes, it’s not your story to tell.  While your practice might be excited to share the positive results of quality patient care, it’s your patients’ right to share their stories. Patients’ medical histories and treatment plans are considered Protected Health Information (PHI), and it’s your practice’s responsibility to safeguard all sensitive patient data.  Cadia Healthcare Facilities is the latest rehabilitation organization caught in the Office for Civil Rights’ (OCR) crosshairs after improperly disclosing patient health stories online. Notified by a patient complaint, the OCR investigated the organization and settled the violation with a $182,000 fine and a two-year Corrective Action Plan (CAP). A major financial and reputational hit, paired with thorough government monitoring, is a lesson learned for the organization.  The 20th fine of the year teaches healthcare practices the importance of HIPAA-compliant marketing, website management, and patient consent.    What Happened?  The rehabilitation organization implemented a Success Story section on its site, with 150 patients’ stories publicly highlighted on the page. This page had extensive PHI, including a patient’s name, image, conditions, treatment, and recovery plans.  While Cadia Healthcare Facilities utilized the website with good intentions, these Success Stories quickly turned into HIPAA horrors. The reason why? Missing HIPAA authorization forms for all 150 featured patients. Then, a patient contacted the OCR with concerns about their image being used without permission on the Cadia Healthcare Facilities website. That’s when the OCR discovered the rehabilitation organization’s noncompliant website and impermissible disclosures.  In addition to the fine and government monitoring, the organization must notify all impacted patients that their information was breached on its site, per the Breach Notification Rule.   Share Online Compliantly Posting your practice’s accomplishments online might be exciting, but your practice must handle it carefully.  Your practice must obtain a HIPAA authorization form before publicly sharing patients’ PHI. This includes before-and-after photos, testimonials, and, in this case, success stories. The forms must be written and specific, and patients can withdraw permission at any time.  Your practice’s online presence is likely a new patient’s first impression, so it’s essential to maintain and update your webpage. However, having more likes and views should never outweigh your commitment to compliance and patient protection. Are you confident your staff understands how HIPAA compliance extends to social media and other forms of marketing? With smart software, your practice can easily train and provide staff with the required documents for HIPAA-compliant social media use. The right compliance solution will empower your staff to handle HIPAA compliance with ease, allowing them to build an online presence while keeping patient data safe.  To learn more about HIPAA compliance for your practice, meet with a compliance expert today. 

Business Associate Phishing Fine
Abyde News, Business Associates, Fines, HIPAA

Phished and Fined: A $175,000 HIPAA Lesson for Business Associates

August 26, 2025 No comments yet

August 26, 2025 When scrolling through your inbox, letting your guard down is easy. Maybe you click on that email that looks like it’s from your bank without hesitation, or are swayed by the unsolicited message for a random all-expenses-paid trip. Unfortunately, phishing emails are everywhere, and they target the healthcare industry due to the sensitive nature of Protected Health Information (PHI). BST & Co., CPAs, LLP, known as BST, is a victim of phishing scams. The New York accounting and consulting firm, which works with practices, received the latest HIPAA enforcement, with a $175,000 fine and a two-year Corrective Action Plan or close monitoring by the Office for Civil Rights (OCR). The OCR discovered, after the fallout of a phishing email, that the Business Associate (BA) had failed to complete a Security Risk Analysis (SRA). This is the 10th enforcement of the Risk Analysis Initiative since its introduction last year. An SRA is a requirement for all HIPAA-regulated entities to assess all potential vulnerabilities of any physical, technical, or administrative safeguard in their organization. By identifying any concerns before a breach occurs, organizations are able to better safeguard PHI, keeping both their business and patients safe. This fine reminds us that BAs are just as responsible for upholding HIPAA as traditional medical practices and that completing the SRA is paramount. What Happened? On December 4, 2019, malware entered BST’s network after a successful phishing attempt. From December 4 to December 7, 170,000 patients’ PHI was exposed. The OCR began its investigation after BST reported the breach in February 2020. The OCR discovered that BST had not completed a thorough SRA. With a thorough SRA, BST could have seen the vulnerabilities regarding emails, or even how they secured Covered Entities’ PHI, and either prevented this breach or minimized its impact. Compliant Business Associates Keep Patients Safe Even though BST wasn’t treating patients directly, as an accounting and consulting firm they still had access to a Covered Entity’s PHI. That’s a clear reminder of just how important it is to make sure your Business Associates (BAs) are fully compliant. When your BA follows a comprehensive HIPAA compliance program, your practice gains peace of mind and a stronger, more secure partnership. The right solution helps you stay ahead of your BA responsibilities, whether that’s generating and maintaining Business Associate Agreements, providing staff training with practical tips like email safety, or completing a Security Risk Analysis (SRA) to uncover hidden risks. Connect with our team of compliance experts today to learn more.