BA Archives

Abyde News, Business Associates, Fines, HIPAA

Phished and Fined: A $175,000 HIPAA Lesson for Business Associates

August 26, 2025 Penelope Schweitzer No comments yet

August 26, 2025 When scrolling through your inbox, letting your guard down is easy. Maybe you click on that email that looks like it’s from your bank without hesitation, or are swayed by the unsolicited message for a random all-expenses-paid trip. Unfortunately, phishing emails are everywhere, and they target the healthcare industry due to the sensitive nature of Protected Health Information (PHI). BST & Co., CPAs, LLP, known as BST, is a victim of phishing scams. The New York accounting and consulting firm, which works with practices, received the latest HIPAA enforcement, with a $175,000 fine and a two-year Corrective Action Plan or close monitoring by the Office for Civil Rights (OCR). The OCR discovered, after the fallout of a phishing email, that the Business Associate (BA) had failed to complete a Security Risk Analysis (SRA). This is the 10th enforcement of the Risk Analysis Initiative since its introduction last year. An SRA is a requirement for all HIPAA-regulated entities to assess all potential vulnerabilities of any physical, technical, or administrative safeguard in their organization. By identifying any concerns before a breach occurs, organizations are able to better safeguard PHI, keeping both their business and patients safe. This fine reminds us that BAs are just as responsible for upholding HIPAA as traditional medical practices and that completing the SRA is paramount. What Happened? On December 4, 2019, malware entered BST’s network after a successful phishing attempt. From December 4 to December 7, 170,000 patients’ PHI was exposed. The OCR began its investigation after BST reported the breach in February 2020. The OCR discovered that BST had not completed a thorough SRA. With a thorough SRA, BST could have seen the vulnerabilities regarding emails, or even how they secured Covered Entities’ PHI, and either prevented this breach or minimized its impact. Compliant Business Associates Keep Patients Safe Even though BST wasn’t treating patients directly, as an accounting and consulting firm they still had access to a Covered Entity’s PHI. That’s a clear reminder of just how important it is to make sure your Business Associates (BAs) are fully compliant. When your BA follows a comprehensive HIPAA compliance program, your practice gains peace of mind and a stronger, more secure partnership. The right solution helps you stay ahead of your BA responsibilities, whether that’s generating and maintaining Business Associate Agreements, providing staff training with practical tips like email safety, or completing a Security Risk Analysis (SRA) to uncover hidden risks. Connect with our team of compliance experts today to learn more.

Abyde News, Best Practices, Business Associates, HIPAA

Under the Microscope: Your Business Associates Are Now the OCR’s Top Priority

August 4, 2025 Penelope Schweitzer No comments yet

August 4, 2025 Let’s talk paperwork. While that might not seem like the most interesting or important thing to focus on when running your practice, having the right documentation is key to its success. A Business Associate Agreement (BAA) is one of the many documents you need to be HIPAA compliant when running a practice. When working with Business Associates (BAs), or the third-party vendors who can access your practice’s Protected Health Information (PHI), you must have a signed agreement in place. These BAs can include anyone from your IT company to the company that handles your shredding. In short, if a business has any access to PHI, it’s required. The Office for Civil Rights (OCR) has put Business Associates (BAs) in the hot seat, with proposed new legislation strengthening their requirements and millions of dollars in fines imposed this year alone. It’s time to take a fresh look at your partnerships, and the best place to start is by having a solid BAA. What does a BAA do? First things first, what does a BAA even do for your practice? What does it include? Well, this required agreement outlines all responsibilities your practice and business partner must follow when handling PHI. The document includes the definition of PHI, when the BA can use the data, and how each party must secure data. This legally binding agreement ensures each party understands the serious nature of handling PHI. Overall, it’s another layer of protection to clearly define your relationship with a BA. A BAA is essential, especially when a Business Associate experiences a data breach. Business Associates are frequent targets for malicious actors. One of the first fines in 2025 was a $90,000 penalty for a ransomware breach that targeted a data hosting company. This breach exposed the PHI of patients from 12 different healthcare practices. These 12 healthcare practices would also need a BAA with the hacked party. If not, the Covered Entity could also be liable for the BA’s missteps. The OCR has also fined Covered Entities for missing a BAA. Here’s a prime example: A healthcare provider was in a nasty dispute with their BA. They even reported the BA to the OCR, claiming the BA was holding PHI hostage for a $50,000 payment. But here’s where it took a turn: The OCR didn’t just investigate the BA; they also focused on the healthcare provider. The result? The OCR slapped the provider with a $100,000 fine for missing crucial documentation, including, you guessed it, a BAA. Keeping BA Partnerships Secure While ensuring documentation is in order is no one’s idea of fun, protecting your practice and keeping patients’ data safe is imperative. With the right solution, your practice can make documentation a piece of cake. While a BAA may not be as appealing as chocolate fudge, software can streamline the process, creating a legally sound and complete document that is just as satisfying. Meet with an expert today to learn more about ensuring compliant vendor relationships.

Abyde News, Fines, HIPAA

Ransomware Reality Check: Business Associate Pays Big HIPAA Fine

June 2, 2025 Penelope Schweitzer No comments yet

6/2/2025 Did you know Business Associates (BAs) are at risk for ransomware attacks just as much as Covered Entities? Ransomware attacks disproportionately affect healthcare organizations, with malicious actors looking to exploit Protected Health Information (PHI). When PHI includes sensitive information such as Social Security Numbers, addresses, phone numbers, and more, it provides someone with a lot of information to use for the wrong reasons. A medical billing BA in Massachusetts, Comstar, LLC, recently experienced the fallout of a ransomware attack. Trusted with the PHI of over 70 practices, the organization did not have the proper safeguards to mitigate risk after a cybercrime. Part of this was a missing Security Risk Analysis (SRA), or a thorough assessment of an organization’s potential vulnerabilities. This latest enforcement represents the responsibility of BAs to uphold their commitments and for all HIPAA-regulated entities to complete and maintain an SRA. What Happened? In May 2022, a malicious actor intruded Comstar’s network servers. Comstar was unaware of this intrusion for several days. In the meantime, the hacker encrypted nearly 600,000 patient records with ransomware. Even though these patients weren’t directly Comstar’s, they assumed the responsibility of protecting their data. While it is not public what steps Comstar took to mitigate risks after the initial ransomware breach, it was discovered that the organization did not complete an SRA. This assessment is at the foundation of a compliant practice and is a requirement of HIPAA. After this discovery, the organization was fined $75,000 and put under a Corrective Action Plan (CAP), or government monitoring, for two years. This assessment is at the foundation of a compliant practice and is a requirement of HIPAA. Recently, the Office for Civil Rights (OCR) has sharpened its focus on this commonly missed requirement with the latest Risk Analysis Initiative. This fine is the 9th enforcement of this initiative. Streamlining the SRA with Software When less than 20% of BAs could showcase a compliant SRA when being audited, completing the SRA is unfortunately a common oversight by regulated entities. Additionally, this is a responsibility of both Covered Entities and BAs, and both parties must carefully handle PHI. With smart software, BAs can easily streamline the SRA and complete the assessment that pinpoints common vulnerabilities organizations face. By simplifying the SRA, intelligent solutions can empower an organization to cultivate a culture of compliance for its staff, securely meet requirements, and handle PHI. To learn more about how your organization can easily complete the SRA, meet with a compliance expert today.

Business Associate Risk Analysis Initiative Fine

Abyde News, Business Associates, Fines, HIPAA

Business Associate Accountability: Health Fitness Corporation’s $227k HIPAA Fine

March 27, 2025 Penelope Schweitzer No comments yet

March 27, 2025 With over $3.5 million of fines levied against Business Associates (BAs) so far in 2025, it’s fair to say that the Office for Civil Rights (OCR) is serious about holding them accountable. These fines in 2025 serve as a reminder that BAs play a crucial role in safeguarding Protected Health Information (PHI). The latest BA HIPAA fine was enforced on the Health Fitness Corporation, which offers wellness plans nationwide. After a flurry of breach reports, Health Fitness Corporation found itself in the crosshairs of a HIPAA investigation. This investigation exposed some critical missteps, leading to a $227,816 settlement and a two-year Corrective Action Plan (CAP). At the center of this fine is a missing Security Risk Analysis (SRA). The SRA is a thorough assessment that identifies the organization’s vulnerabilities. This fine was also the fifth enforcement of the Risk Analysis Initiative, a recent program by the OCR to ensure regulated entities complied with this HIPAA requirement. This fine not only spotlights the importance of Business Associates following HIPAA, but also for all regulated entities to be aware of the Security Risk Analysis requirement. What Happened? In August 2015, PHI was exposed online due to a server misconfiguration. This breach was not discovered in June 2018, with an estimated 4,000 patients impacted by this security issue. Four breach reports describing this incident were filed from the end of 2018 into early 2019. This led to the OCR investigating Health Fitness Corporation. It was then uncovered that the organization did not complete a thorough SRA until 2024. The SRA is an annual requirement for every HIPAA-regulated entity. This assessment should also be completed after any breach to review and address vulnerabilities. As a result, the wellness program organization was fined $227,816 with government monitoring for the next two years. How to Protect Your Organization When working with PHI, all involved parties must know their responsibilities. For Covered Entities and Business Associates, having a Business Associate Agreement (BAA) with any third parties with access to PHI is vital. BAAs define each party’s responsibilities, creating legal liability. This required document demonstrates that each party is willing and able to take responsibility for protecting sensitive patient data. In addition to being aware of HIPAA responsibilities, ensure your organization completes an SRA annually, and anytime a breach occurs. Risks can be mitigated by being on top and informed about your organization’s vulnerabilities. Utilizing a smart software solution can streamline these requirements. Smart solutions can streamline the SRA and any BAAs, protecting your organization. To learn more about how you can automate and streamline compliance in your practice, schedule a consultation with an expert today.

Business Associates, Fines, HIPAA

Choose Your Business Associates Wisely: An $80K Mistake

January 8, 2025 Penelope Schweitzer No comments yet

January 8, 2025 As we ring in the new year, it’s important to remember that Business Associates (BAs) are just as responsible for protecting patient health data as their Covered Entity counterparts. A major misstep by a BA was highlighted recently on a federal level, and the first fine of 2025 was imposed. Elgon, a Massachusetts-based medical record and billing support company for Covered Entities, was levied a $80,000 fine due to numerous violations of the Security Rule, which were exposed by the fallout of a ransomware attack. As a proposed update to the Security Rule is currently open for public comment and may take effect in the spring, it is crucial for Covered Entities to select Business Associates (BAs) who prioritize compliance. BAs are just as responsible for ensuring that Protected Health Information (PHI) is kept secure. What Happened? Elgon was the victim of a ransomware attack on March 25, 2023. Unfortunately, the BA didn’t realize the intrusion of its firewalls for over a week until a ransom note was discovered. Elgon then reported the breach, which affected over 30,000 patients of a Covered Entity. Thousands of social security numbers, addresses, and other personally identifiable information were leaked from the attack. When Elgon was investigated, it was uncovered that the organization failed to recognize its risks in a Security Risk Analysis (SRA). The SRA is at the foundation of a successful practice or business, giving an organization a benchmark on how it handles PHI and how it can improve. This fine is also the second enforcement of the OCR’s Risk Analysis Initiative, highlighting the importance of completing and maintaining this assessment. How to Protect Your Organization Covered Entities and Business Associates need to uphold their commitment to protecting patient data. This recent fine is a stark reminder of what can happen when the proper procedures are not followed, exposing the personal information of thousands of patients. To avoid and mitigate situations like this, Covered Entities must carefully choose the right BA to work with, ensuring they also understand the importance of protecting patient data. For BAs, having the proper safeguards in place is vital, earning trust from Covered Entities that you can keep their patients’ PHI safe. A key document that establishes the liability of both parties is the Business Associate Agreement (BAA). The BAA is a written document required when working with Business Associates and vice versa. This signed agreement ensures both parties know their responsibilities when handling patient data. Proposed updates to the Security Rule expand on this, with BAs potentially having to verify they are enforcing the proper safeguards on a yearly basis, certified by a compliance expert. Overall, this fine sets the tone for a new year of significant changes and enforcement by the OCR. Covered Entities and Business Associates must both understand their critical role in protecting patients. To learn more about how you can become HIPAA compliant, schedule a consultation with our team of experts today.

Best Practices, Business Associates, HIPAA

1-800-HIPAA: Guide to Compliant Phone Calls

April 12, 2024 Gaurav Modi Comments Off

April 12, 2024 Brrring Brrring Brring! It’s your friends from Abyde calling! Pick up! We have some worthwhile tips and tricks to share with you today. While we all love a good chat on the phone when working with Protected Health Information (PHI), it’s key to keep things confidential. That’s why today, pick up our call and learn how your practice can make compliant phone calls. By following our tips, you’ll be a confident phone pro, ready to chat with patients while keeping their privacy a top priority. So, are you ready to answer? Let’s get started! Hello, it’s HIPAA In the digital age, there are numerous ways to connect and share information with patients. Reaching out to patients through the phone is still a common practice, but you need to be able to navigate it safely. First, ensure your phone systems are HIPAA-compliant before sharing any PHI. This includes end-to-end encryption, user authentication, audit control, automatic log-off, and other strong security features. When onboarding with a cloud-based phone service, make sure a Business Associate Agreement (BAA) is signed with the provider, ensuring accountability and liability when it comes to the protection of patient data. Listen, we know you might be itching to chat after your visit – you genuinely care about our patients and their well-being, but there aren’t a ton of reasons to call a patient. While HIPAA restricts casual chit-chat, some of the reasons to call a patient include: Additionally, if you are calling a Business Associate (BA), make sure a BAA is signed before communicating any PHI through the phone. When in Doubt, Leave it Out! When on the phone with a patient or a BA and you’re disclosing PHI, the Minimum Necessary Requirement is at play. As in the name, this standard means only the minimum necessary information about a patient’s health information should be disclosed. FCC, or the Federal Communications Commission has come out and given guidance on HIPAA-compliant phone calls. Keep it short and sweet! Phone calls should be less than 60 seconds or less than 160 characters in text length. And, don’t blow up any patient’s phone with calls! The FCC says patients should only receive three calls a week, or one text a day. To ensure patient privacy and clear communication, keep calls brief and focused. Before sharing any information, take a moment to verify the patient you are speaking with. Phoning Family While it’s only normal for a family to worry about a patient’s health, sharing this information is a different story. Under HIPAA, the patient has to agree for their PHI to be shared with family. Once again, only the minimum information required can be shared. However, if a patient is incapacitated, PHI can be shared with the family if it’s considered in their best interest. Once a patient is lucid again, the patient can retract permission for PHI to be shared with family. Dialing Up Patient Trust Phone calls are a common and effective way to quickly share information with patients. Like anything regarding PHI, it’s vital to stay compliant, keeping patient information secure. By properly handling phone calls at your practice, you’ll strengthen patient trust, improve communication, and reduce compliance risks with the right tools. Abyde can be one of those trusted tools, being a cloud-based solution that streamlines the compliance process. Abyde will assist you in having everything you need to be compliant, keeping you in check and creating a culture of compliance at your practice. To learn more about what your practice needs to do to be compliant, email info@abyde.com, call us at 1.800.594.0883, and schedule a consultation here.

Best Practices, Business Associates, HIPAA

Abyde Feature Week: BA | CE Portal

March 21, 2024 Gaurav Modi Comments Off

March 21, 2024 Let’s go! Day number four of Feature Week. We hope you’ve stayed tuned as we go over all the wonderful features that make Abyde the leading compliance software for Business Associates (BAs). We know that running your business can be tough, so we simplify compliance, so you can focus on being successful in your business. So far, this week we’ve gone over our intuitive Security Risk Analysis (SRA), our unique Scorecard, telling you what you need to do to be compliant based on your answers, and yesterday, our dynamically generated custom Policies and Procedures, saving your business countless hours in drafting documentation. How does this software get even better? Well, it does! Today, we’ll go over our state-of-the-art BA and CE (Covered Entity) Portal, where you can manage your Business Associate Agreements (BAAs). As we say here at Abyde, who does it better than us? NOBODY! BAA-lieve It or Not: The Importance of Business Associate Agreements A Business Associate Agreement, or a BAA, is an agreement between a BA and CE, or a Sub-BA, that outlines the roles and responsibilities of both parties when it comes to securing Protected Health Information (PHI). In simpler terms: a contract that spells out what each party needs to do when it comes to HIPAA compliance. One of the top HIPAA violations BAs make is not having a Business Associate Agreement in place. This agreement is required by the government, making sure both parties are aware of the responsibilities that come along with handling sensitive patient information. BAs must have agreements in place with all CEs and Sub-BAs they work with. Managing these agreements could be complicated without Abyde, being unaware of what needs to go into an agreement, getting it over to be signed and knowing when these agreements expire. But with Abyde, you don’t need to worry about this, simplifying the compliance process even more. Like how we dynamically generate custom Policies and Procedures, we create BAAs for you. All we need you to do is digitally sign. The BAA will be sent over by email through the software and will be stored in our nifty BA | CE Portal. Have an agreement expiring soon? We’ll notify you, giving you plenty of time to update your documentation so you can stay compliant. All BAAs are easily downloadable from the software and can be reviewed at all times. Have a partner who hasn’t signed yet? We’ll send reminders for them, too. With our revolutionary features, we think it’s clear: we want to make compliance the easiest part of running your business. To learn more about how you can manage your Business Associate Agreements with the Abyde software, email info@abyde.com and see it in action here.

Business Associates, HIPAA

Top Mistakes of Business Associates in Healthcare: How to Avoid Partnership Pitfalls

March 13, 2024 Gaurav Modi Comments Off

March 13, 2024 Hi Business Associates (BAs)! We know that working with healthcare practices adds the stress of securing the Protected Health Information (PHI) of patients. Running a business and protecting patients can be tough, but it’s a requirement under HIPAA. This shared responsibility is key to keeping your business compliant, allowing you to have a successful business, happy partners, and of course, safe patients. Here are some of the most common compliance violations BAs make, and how you can avoid them. Dude, Where’s My Business Associate Agreement? The first thing a Business Associate needs to do is sign a Business Associate Agreement (BAA) when working with a Covered Entity (CE). BAAs are a game plan for our business alongside healthcare practice. With a proper BAA, your organization has documentation of your shared responsibilities to keep PHI secure. If there’s anything you need to know about compliance, it’s to document everything! This BAA includes important information about permitted uses and disclosures of PHI, safeguards that the BA is expected to establish, Breach Notification requirements, training requirements and more. Now, this map of your partnership seems like a pretty easy thing to do, especially because it takes some liability off of your shoulders. However, one of the most common violations of HIPAA for BAs is not having this agreement documented. There have been millions of dollars in fines that stem from one simple thing: not having a BAA. It’s a simple step your business has to take, and with Abyde, we make it easy. With our software, we will draft a personalized BAA for your organization. All you have to do is sign it and send it off to your CE partner. Worried about losing this BAA? Don’t worry! It lives in the software having this documentation readily available for your business. Getting Schooled A Lack of training is another top mistake for BAs. Once again, as a BA, it is imperative to be aware and educated on compliance. While compliance training might not exactly be as exciting as a Rocky montage running around Philly, it is very important, and when done right, can be fun. Abyde nails entertaining training with our interactive material, simplifying complicated topics into top-notch training. Once again, training is vital for BAs, and when not completed, the consequences can be severe. When you violate HIPAA rules, like not training, the minimum fine is $137 per incident. Something like that can add up pretty quickly. Additionally, training is so important in promoting a culture of compliance, ensuring all employees know the essential role they play in your business. Breach Bandits Unfortunately, breaches are common in healthcare. While it is imperative to take proper precautions against breaches, like having an IT company’s assistance, controlled access, and more, it can still happen. Sometimes, no matter how hard you secure your business, breach bandits still find a way through your security. While it might happen to you, you can always control how you handle the situation. Before a breach even occurs, you need to take the proper cybersecurity precautions, and also complete a Security Risk Analysis (SRA). After a breach, it is required to follow the Breach Notification Rule of HIPAA. The Breach Notification defines what your business needs to do if it is impacted by a breach, including how it needs to be reported and how it must be shared with affected patients. The consequences of improperly handling a breach can be catastrophic, with major fines affecting your business. For example, the first ransomware attack ruled on by the OCR impacted a BA. This Business Associate was caught in the crosshairs of a ransomware attack and was fined $100,000 due to their lack of a SRA and having no policies and procedures in order. Now, dun dun dun! That’s where Abyde steps in again. Our software includes a simple SRA for your business to complete, going through all OSHA requirements in a questionnaire that takes minutes to complete. Well, you might now be wondering: What about policies and procedures? How do I quickly write those? I don’t know what I need? Well, the Abyde software has dynamically generated policies and procedures for your practice, drafted in seconds. Overall, your friends at Abyde know that running both a successful business AND ensuring the protection of patients’ data can be complicated, and that’s why we’re here to help. Abyde is the simple solution for all of your compliance concerns, with our intuitive software making compliance easy. To learn more about how Abyde can eliminate your business’ compliance worries, email us at info@abyde.com or schedule a consultation here.

Business Associates, HIPAA

Shredding for Secrecy: Why BA’s Proper Disposal Matters

March 1, 2024 Gaurav Modi Comments Off

March 1, 2024 Handling the complexities of HIPAA regulations can feel like walking a tightrope for healthcare providers. Every interaction with Protected Health Information (PHI) – from creation to disposal – carries potential risk. Fortunately, they’re not alone. Shredding companies, step into the crucial role of Business Associates (BAs), becoming vital partners in ensuring HIPAA compliance. When Disposal Companies Wear the BA Hat: Not all disposal companies fall under the BA umbrella. The key factor hinges on access and interaction with PHI. If a company directly receives, handles, or disposes of PHI on behalf of a covered entity like a hospital or clinic, they automatically become BAs. This means they’re bound to HIPAA legislation, becoming directly liable for the protection of patients’ data. Why Shredding BAs are Essential for HIPAA Compliance: Beyond just disposing of paper, disposal BAs bring critical expertise to the table: Paper-Thin Excuses: The Consequences of Improper Disposal The consequences of improper disposal of PHI can be severe. For instance, the New England Dermatology and Laser Center was fined over $300,000 due to improper disposal of PHI, and having health information in a garbage bin in their parking lot. Data security isn’t a solo act. Recognizing disposal BAs as active partners in the HIPAA compliance journey strengthens the entire healthcare ecosystem. By choosing trusted BAs and fostering open communication, covered entities can leverage their expertise and navigate the ever-evolving regulatory landscape with greater confidence. For Business Associates, being compliant is beyond good business practices, it’s upholding your commitment to patients’ data. Abyde’s newest software, HIPAA for Business Associates is here to simplify compliance for your organization. Abyde’s software includes training, security risk analysis, a BA and CE portal, and many more resources to assist your organization. To learn more about compliance for your organization, email info@abyde.com and schedule a demo today here.

Business Associates

IT in the White Coat: The Crucial Role of IT Companies in Healthcare

February 12, 2024 Gaurav Modi Comments Off

February 12, 2024 The medical field is undergoing a digital revolution, and IT companies are more than just the folks building all the fancy gadgets. They’re putting on virtual white coats and becoming Business Associates (BAs), working hand-in-hand with healthcare providers. But this isn’t just about cool tech – it’s about protecting something crucial: your health information. So, what exactly do BAs do? The Health Insurance Portability and Accountability Act (HIPAA) defines BAs as any person or entity that creates, receives, transmits, or maintains protected health information (PHI) on behalf of a covered entity, such as a hospital or health insurance provider. This means IT companies involved in tasks like: Responsibilities and Actions: Becoming a BA comes with a significant responsibility to comply with HIPAA regulations. Here’s what IT companies, as BAs, must do: Beyond Compliance: Building Trust and Value: While compliance is paramount, IT companies can go beyond the minimum requirements and truly become valuable partners in healthcare. Here are some ways: The Future of IT in Healthcare: The future of healthcare is digital, and IT BAs are the key to keeping it safe and secure. By embracing their responsibilities and working together, they can ensure that technology not only revolutionizes healthcare, but also protects what matters most – the health and safety of patients. To learn more about our IT partners, click here. To learn more about how to keep your IT organization compliant, email info@abyde.com and schedule a compliance consultation here.