4.24.25 As we head into the middle of the year, it’s safe to say that the Office for Civil Rights (OCR) is ramping up enforcement. Since the beginning of this year, over $6M in fines have been levied, with new penalties being announced weekly. The latest fine showcases that the OCR can and will investigate breaches no matter your organization’s size. The latest HIPAA fine was imposed on PIH Health, Inc. (PIH), a California health network comprised of over a hundred health practices throughout the state. PIH’s HIPAA violations have cost the organization $600,000. Due to these violations, the organization will be monitored for two years under a Corrective Action Plan (CAP). These violations exposed numerous shortcomings of the organization due to a phishing attack, emphasizing the importance of thorough safeguards for practices of all sizes. What Happened? In June 2019, a phishing attack compromised 45 PIH employee accounts. This breach devastated an organization with millions of patients, putting nearly 200,000 patients at risk. While the phishing attempt occurred in the summer of 2019, the breach was not reported to affected patients or the OCR until January 2020. When a breach impacts over 500 patients, time is of the essence. Parties must be notified within 60 days of the breach, including widespread press releases for the media. More issues were brought to light once the OCR was aware of this breach. The organization lacked a sufficient Security Risk Analysis (SRA). The SRA is an exhaustive assessment of a practice, reviewing all safeguards and highlighting any vulnerabilities before a breach occurs. This is at the base of a compliant practice, and the OCR has introduced the Risk Analysis Initiative to ensure that practices have this documentation in place. Overall, this successful phishing attempt revealed inadequacies and several HIPAA violations. In addition, the organization’s failure to notify the OCR and patients promptly also contributed to the severity of the fine. Protecting Patient Data The healthcare industry’s sensitive data makes it the prime target for phishing attacks. Healthcare organizations must provide comprehensive staff training to avoid suspicious emails and, in general, risk mitigation techniques. Healthcare practices must always address the breaches quickly. Timely notification of the OCR and affected patients ensures that all parties are aware of the breach’s impact and understand how to monitor their data. No matter the organization’s size, using smart software can help simplify compliance, avoid significant fines, and reduce patient data risk. For example, the SRA can be streamlined with compliance software, ensuring your practice knows the appropriate safeguards before an incident occurs. Intelligent solutions also provide your practice with a centralized compliance hub, letting staff know precisely what they need to secure patient Protected Health Information (PHI). To learn more about how your practice can streamline common HIPAA violations, schedule a meeting with a compliance expert today.
Don’t Be Next: HIPAA Fine Shows Risk of Ignoring Security Risk Analysis
April 17, 2025 Let’s make this clear: The Security Risk Analysis (SRA) is at the foundation of a compliant practice. The SRA is the proactive assessment of your practices’ physical, technical, and administrative safeguards. Physical safeguards include alarms, codes, and other procedures or devices your practice might deploy. Technical safeguards involve cybersecurity protocols, like firewalls, antivirus software, encryption, and other security measures. Lastly, the administrative safeguards are your practice’s actions, such as using visitor IDs, maintaining a sign-in sheet, or even posting about patients on social media. The latest HIPAA fine is another reminder of the importance of the SRA in protecting patient data. This is the sixth Risk Analysis Initiative enforcement since the end of last year. The Office for Civil Rights (OCR) is serious about ensuring that practices know this requirement. This focus has remained consistent even during administration transitions. Said best by OCR Acting Director Anthony Archeval, “A failure to conduct a risk analysis often foreshadows a future HIPAA breach.” What Happened? Northeast Radiology, P.C. (NERAD), a healthcare provider specializing in medical imaging clinical services in New York and Connecticut, experienced a significant breach that exposed nearly 300,000 patients’ Protected Health Information (PHI). The breach, which occurred from April 2019 to January 2020, was caused by unauthorized individuals accessing radiology images of patients due to a compromised server. When the OCR began investigating the practice in March 2020, it was discovered that NERAD did not have an SRA. Due to the absence of this document and the sheer size of the breach, the organization was fined $350,000 and will undergo a two-year Corrective Action Plan (CAP). Completing an SRA NERAD’s HIPAA settlement with the OCR is a clear reminder that your practice needs to complete an SRA long before a breach occurs. While an SRA might seem daunting, addressing problems before patients’ information is at risk is much easier. Completing this risk assessment can help your practice identify vulnerabilities before they escalate into compliance issues. While the SRA mandates practices to analyze and review existing procedures thoroughly, this process doesn’t need to be overwhelming or costly. With smart solutions, your practice can answer simple questions about your practice while the software intuitively builds out an SRA report, analyzes the current situation, and provides recommendations to mitigate potential risks. To learn more about how your practice can streamline the SRA, schedule a consultation with an expert today.
The HIPAA Audit Wake-Up Call: Is Your Practice Compliant?
April 10, 2025 The HIPAA Audit program is back in business. Since the introduction of the Health Information Technology for Economic and Clinical Health (HITECH) Act, the Office for Civil Rights (OCR) has been able to audit practices, ensuring they follow HIPAA standards. While the revival of the audit program was announced last May, new information was confirmed at the latest HIPAA Summit, with 50 Covered Entities and Business Associates being selected to be audited. This program was last active from 2016-2017, which highlighted that, unfortunately, noncompliance with HIPAA is far too common in regulated entities. In fact, only 14% of Covered Entities, like medical practices, could produce a compliant Security Risk Analysis (SRA). The healthcare industry is entering a new era of HIPAA compliance in the wake of the largest ever healthcare data breach. New HIPAA legislation is being reviewed and the Office of the Inspector General (OIG) is recommending stricter audit processes. With millions in fines already imposed in 2025, proactive preparation is now critical for healthcare providers and their business partners. What is the Audit Program? The audit program was first introduced when the HITECH Act was enacted in 2009. While the majority of the investigations the OCR conducts are reactive, resulting after a patient complaint or a breach, the audit program is random. The OCR will thoroughly review the selected organization’s documentation and current processes as the audit program resumes. A compliant HIPAA program entails much more than training; it also requires comprehensive, continuous protocols to ensure patient data is being protected. The basis of a compliant practice is being able to present an SRA. As stated earlier, previous audit programs spotlighted the shortcomings of regulated entities completing this. The SRA is a thorough assessment of your practice. This includes reviewing the safeguards your practice currently has in place. Technical, physical, and administrative safeguards all play a role in securing Protected Health Information (PHI). This would include a deep dive into the technology your practice uses, the physical protections your practice might have (like alarms), and the administrative policies your practice follows. Completing this analysis will allow your practice to identify vulnerabilities before a breach occurs. Proactive compliance, addressing issues before they affect patients, is key to a successful practice. In addition to providing an SRA, practices must also prove compliance with other pillars of HIPAA compliance, such as the Right of Access (or sending requested medical records to practices in a timely manner), the Breach Notification Rule, the Privacy Rule, and more. After the rise in ransomware attacks in recent years, with a nearly 300% increase in ransomware-related breaches, regulated entities’ cybersecurity practices will likely be scrutinized, ensuring that those audited are aware of their technology responsibilities. What can I do? Your practice must be aware of HIPAA and implement the appropriate safeguards to be prepared for the possibility of an audit. While this can be a daunting task, it is imperative for your practice to follow HIPAA compliance before a situation occurs. Thankfully, smart software can streamline and simplify HIPAA for your practice, providing a roadmap to compliance. With the right solution, your practice can see exactly what the OCR requires, which will be asked for if ever audited. To learn more about becoming audit-ready, schedule an educational consultation with our team of experts.
Navigating HIPAA in the Digital Age: Patient Communication Essentials
April 2, 2025 When 80% of patients prefer digital communication, exploring this opportunity to better serve your patients is crucial. In the digital world, it’s easier than ever to connect with others and build relationships with others through technology. Connecting with patients via technology is simple, but practices must ensure that all communication, including emails, texts, and calls, adheres to HIPAA regulations. What is HIPAA-Compliant Communication? HIPAA, or the Health Insurance Portability and Accountability Act, is focused on ensuring the security of patients’ Protected Health Information (PHI). PHI includes anything personally identifiable about a patient, including Social Security Numbers, full names, addresses, medical history, and more. When communicating with a patient, it’s vital to implement the proper protocols to keep patient data safe. When patient data isn’t secured through traditional channels, using a regular phone doesn’t cut it. For instance, channels need to be encrypted, providing extra layers of protection. Additionally, it’s important to communicate with patients using the minimum amount of information necessary for a conversation. For example, if a patient texts asking to reschedule an appointment, a practice should offer new times and not go in-depth about a patient’s medical history. Communication should remain brief and focus on justifiable reasons to talk to a patient, like scheduling, post-op instructions, and test results. Patients need to consent to different forms of communication, like texts. The practice is responsible for receiving consent when a patient begins seeing a practice. How can I Implement HIPAA-Compliant Communication? An encrypted communication service is the easiest way to ensure secure communication channels. As communication with patients has become normalized in the healthcare industry, numerous organizations offer HIPAA-compliant communication systems. These systems include compliant and encrypted end-to-end phone calls, texts, and emails. Ensure these companies also do their due diligence and sign a Business Associate Agreement (BAA) with your communications provider. Once a suitable communication system is in place, training staff on communicating effectively and safely with patients electronically is crucial. Staff should be well-versed in the proper procedures for digital patient communication. This includes understanding the Minimum Necessary standard, carefully reviewing messages before sending them to patients (especially to ensure information is being sent to the correct patient), and recognizing phishing scams to verify the authenticity of communications before responding. What’s Next? Communicating with patients leads to a more successful practice, with higher attendance rates and more engaged patients. Digital communication is the future, and with the right tools, you can easily navigate HIPAA-compliant communication. In addition to using digital communication systems, implementing a smart software solution is key to a compliant practice. A centralized compliance hub allows you to easily see your vulnerabilities and organize vital documentation, like BAAs with third-party vendors you may use. Looking to learn more about how you can make your practice more efficient while still following rigorous HIPAA laws? Schedule a meeting with a compliance expert today.
Business Associate Accountability: Health Fitness Corporation’s $227k HIPAA Fine
March 27, 2025 With over $3.5 million of fines levied against Business Associates (BAs) so far in 2025, it’s fair to say that the Office for Civil Rights (OCR) is serious about holding them accountable. These fines in 2025 serve as a reminder that BAs play a crucial role in safeguarding Protected Health Information (PHI). The latest BA HIPAA fine was enforced on the Health Fitness Corporation, which offers wellness plans nationwide. After a flurry of breach reports, Health Fitness Corporation found itself in the crosshairs of a HIPAA investigation. This investigation exposed some critical missteps, leading to a $227,816 settlement and a two-year Corrective Action Plan (CAP). At the center of this fine is a missing Security Risk Analysis (SRA). The SRA is a thorough assessment that identifies the organization’s vulnerabilities. This fine was also the fifth enforcement of the Risk Analysis Initiative, a recent program by the OCR to ensure regulated entities complied with this HIPAA requirement. This fine not only spotlights the importance of Business Associates following HIPAA, but also for all regulated entities to be aware of the Security Risk Analysis requirement. What Happened? In August 2015, PHI was exposed online due to a server misconfiguration. This breach was not discovered in June 2018, with an estimated 4,000 patients impacted by this security issue. Four breach reports describing this incident were filed from the end of 2018 into early 2019. This led to the OCR investigating Health Fitness Corporation. It was then uncovered that the organization did not complete a thorough SRA until 2024. The SRA is an annual requirement for every HIPAA-regulated entity. This assessment should also be completed after any breach to review and address vulnerabilities. As a result, the wellness program organization was fined $227,816 with government monitoring for the next two years. How to Protect Your Organization When working with PHI, all involved parties must know their responsibilities. For Covered Entities and Business Associates, having a Business Associate Agreement (BAA) with any third parties with access to PHI is vital. BAAs define each party’s responsibilities, creating legal liability. This required document demonstrates that each party is willing and able to take responsibility for protecting sensitive patient data. In addition to being aware of HIPAA responsibilities, ensure your organization completes an SRA annually, and anytime a breach occurs. Risks can be mitigated by being on top and informed about your organization’s vulnerabilities. Utilizing a smart software solution can streamline these requirements. Smart solutions can streamline the SRA and any BAAs, protecting your organization. To learn more about how you can automate and streamline compliance in your practice, schedule a consultation with an expert today.
What is Right of Access?: Understanding the HIPAA Privacy Rule
March 20, 2025 HIPAA is often misunderstood as only addressing the security of medical information. However, it encompasses more than that. The Health Insurance Portability & Accountability Act also defines how medical information must be shared with patients through the Privacy Rule. This highlights another key responsibility healthcare providers must be accountable for. Alongside the Security Rule and the Breach Notification Rule, the Privacy Rule provides patients additional rights regarding how their medical records are handled. The Privacy Rule created the Right of Access, requiring practices to provide patients with their medical records in a timely manner. With the latest fine for HIPAA being a Right of Access violation, it’s vital for practices to be aware of this requirement and how it pertains to the care they provide. What is Right of Access? Right of Access gives practices 30 days to fulfill a patient’s request for their records. In some situations, these thirty days can be extended to an additional 30 days, but that is the longest period of time allowed to provide a patient with their records. This is a federal requirement, but the timeline could be even shorter depending on where the practice is located. For instance, if the practice is in California, staff must provide patients with medical records within 15 days. Your practice can charge for medical records, but it needs to be reasonable. The Office for Civil Rights (OCR) defines this as the average cost of supplies, limited labor, and postage when providing medical records to a patient. However, instead of calculating this cost, the OCR also suggested a flat fee not to exceed $6.50 when handling electronic records. Once again, other guidance can be levied on the state level, like California’s cap on the cost of medical records at 25¢ a page plus a reasonable clerical fee. From the moment a practice receives a request, it must be addressed quickly. Staying on top of these requests is crucial for staying compliant and maintaining patient satisfaction. How to Stay Compliant While this might seem simple, many practices have been fined in the past for violating this right of patients. In 2024 alone, Right of Access fines accounted for nearly $500,000. The OCR introduced a Right of Access Initiative to ensure that these patient requests are taken seriously. Many of these investigations and fines stem from patient complaints, showing the importance of complying with this HIPAA component. Utilizing smart software solutions can assist your team in ensuring that all staff members are aware of their responsibilities when handling PHI, including the responsibility to address patient requests quickly. This empowers your team to take accountability and keep patients happy. To learn more about how to comply with HIPAA Right of Access legislation, meet with our team of compliance experts today.
Inside a HIPAA Investigation: A 4-Part Educational Series
March 17, 2025 Getting a HIPAA investigation letter can be overwhelming, but your practice can successfully navigate the process with the right resources. This series is designed to be your easy-to-read guide, walking you through each step of the process. We’ll break down everything from understanding the initial letter to navigating potential outcomes, providing you with best practices to keep your practice confident and prepared if you ever receive a letter. Blog 1: Is Your Practice Prepared for a HIPAA Breach? A common misconception is that a HIPAA breach causes your practice to be fined. Instead, your practice’s lack of proactive measures and proper response to a breach is what leads to disciplinary action. Although it’s impossible to prevent breaches completely, the proper safeguards can minimize their risk and impact. Learn more about breach mitigation here. Blog 2: Decoding the HIPAA Investigation Letter: What to Expect and How to Respond The official start of an investigation is when your practice receives the data request letter from the Office for Civil Rights (OCR). The letter is thorough, with the OCR inspecting your practice’s safeguards in the wake of a breach or a complaint. Learn more about what your practice can expect if they receive a letter here. Blog 3: Responding to a HIPAA Investigation: A Guide to Document Organization From the second your practice gets a letter from the OCR, it’s time to start organizing documentation. Organizing documentation is vital for streamlining the investigation process. Having organized documentation is the key to passing an investigation and avoiding fines. Learn more here. Blog 4: The Final Verdict: HIPAA Investigation Outcomes After months of investigation, the OCR will send a letter to your practice. Various outcomes can occur, from closing the investigation with no fines to corrective action. Learn more about the outcomes of an investigation here. While we hope your practice never has to experience an investigation, things happen. With the right proactive safeguards in place, your practice can minimize the chance of an investigation and be organized and ready if one occurs. With the right resources, like a compliance software solution, your practice can streamline compliance, take control, and easily identify vulnerabilities before they become serious issues. Want to learn more about how you can protect your practice? Meet with a compliance expert today.
Warby Parker’s $1.5 Million HIPAA Fine: A Security Risk Analysis Eye-Opener
March 6, 2025 Warby Parker, the popular prescription eyewear retailer with a strong online presence and expanding physical stores, was recently fined $1.5 million for a HIPAA violation. This enforcement highlights that no matter how big your organization is, the government can and will investigate breaches of PHI. In 2025, the Office for Civil Rights (OCR) has issued over $5 million in fines so far, almost all of which involved a missing Security Risk Analysis (SRA). The SRA thoroughly assesses your practice’s physical, technical, and administrative safeguards for securing patient Protected Health Information (PHI). The Warby Parker fine is a stark reminder that the SRA, a detailed examination of your PHI safeguards, is not just a recommendation; it’s a necessity. What Happened? In late 2018, Warby Parker experienced numerous unusual login attempts on its site. It was discovered that customer logins were breached through credential stuffing or when information was pulled from unrelated breaches. For example, a customer’s login was likely reused on another hacked site. The OCR began its investigation in December 2018, but the flurry of attacks continued. Warby Parker, which also provides eye exams, issued several addendums to its initial breach report, revealing that additional customer and patient accounts were compromised. Additional attacks occurred in 2020 and 2022. Overall, these cybercrimes impacted almost 200,000 patients. As the OCR investigated Warby Parker, it discovered that Warby Parker did not conduct an adequate security risk analysis, implement sufficient technical safeguards to prevent further attacks, or regularly review system access. These failures to protect PHI led to a $1.5 million Civil Monetary Penalty (CMP), demonstrating that even massive organizations need to comply with HIPAA requirements. How to Protect Your Organization The first step to HIPAA compliance for your practice is proactively maintaining an SRA. By evaluating and identifying your vulnerabilities, your practice can address these weaknesses before they become serious problems. As stated before, no matter how small or large your organization is, you must complete the SRA annually. Regular reviews of PHI access are essential to identify and address breaches promptly, minimizing the number of affected patients. Implementing an access log is crucial as well, ensuring staff is held accountable for documenting when they interact with PHI. Utilizing a compliance software solution can alleviate the stress of managing numerous requirements. Software solutions can streamline compliance and offer a SRA and an access log within the program. By outsourcing compliance, your team can focus more time on patient care. To learn how to simplify HIPAA compliance for your practice, schedule a consultation with a compliance expert today.
The Final Verdict: HIPAA Investigation Outcomes
March 3, 2025 Welcome to the fourth and final installment of Abyde’s HIPAA Investigation Survival Series. We’ve already reviewed the initial breach, the letter you received, organizing documentation in response to the letter and data request from the OCR, and now the possible outcomes of a HIPAA investigation. There are a few possible outcomes for a HIPAA investigation. As discussed at the end of the previous blog post, the ultimate judgment from the OCR could be levied months or even years after the investigation started. What are the possible outcomes of a HIPAA Investigation? The most favorable outcome of an investigation is when the OCR closes your investigation. Your OCR investigator will inform you through writing, either through an official email or letter, that your documentation was sufficient, showcasing that your practice is implementing the right safeguards to secure Protected Health Information (PHI). Once an investigation is closed, you’ve officially passed the investigation. However, the OCR can and will levy monetary fines if your documentation is insufficient. Monetary fines range from $141 to over $2 million per violation. Fines are tiered, starting with tier 1, which is the least serious based on a sincere lack of knowledge of a violation, to tier 4, or willful neglect of a situation if not corrected within 30 days. These fines are also adjusted yearly based on inflation. HIPAA fines are categorized into two types: Civil Monetary Penalties and Settlements. Civil Monetary Penalties are imposed when a practice is found guilty of violating HIPAA regulations. The practice and the OCR negotiate settlements, and the practice does not admit to any HIPAA violations once paying the fine. Both forms of penalties are highlighted on the OCR’s website as press releases and written about by numerous healthcare compliance news professionals, meaning this fine will live on the internet forever. Lastly, the OCR can levy a Corrective Action Plan (CAP) in addition to a monetary penalty. A CAP requires a fined practice to be monitored by the OCR for several years, as defined by the CAP. This leaves the practice subject to government scrutiny, another hurdle. How Can I Avoid This? Proactive measures are key when it comes to avoiding a HIPAA investigation. By implementing the appropriate safeguards before a situation occurs and properly training all staff, your practice can avoid common mistakes leading to breaches. Utilizing a software solution is imperative when handling HIPAA compliance. Outsourcing compliance streamlines compliance for your practice, freeing your time and providing an easily accessible hub for all documentation. To learn more about simplifying HIPAA compliance for your practice, schedule a consultation with one of our experts today. To visit our first installment of this series about the breach that likely causes an investigation, please visit here, learn more about the audit letter, visit here, and learn more about organizing documentation for an investigation here.
Responding to a HIPAA Investigation: A Guide to Document Organization
February 24, 2025 Welcome to the third installment of Abyde’s HIPAA Investigation Survival Series. We’ve reviewed the initial breach and the letter itself, and now we will review those steps you need to take when organizing documentation to send back to the OCR. As discussed in our last blog post, you must start organizing documentation immediately after receiving an investigation letter. Since the turnaround is usually 30 days, it’s important to have documentation sent promptly to your investigator. Proper organization of documents is essential for a successful practice. How Should I Organize Documentation? The OCR will specify the documentation required in the initial investigation letter. For instance, if your practice experienced a ransomware attack, the OCR will likely ask specific questions about your practice’s cybersecurity safeguards. This response can be sent either through traditional mail or by email. If using email, ensure that the email is properly encrypted if any Protected Health Information (PHI) is mentioned. When responding to the OCR, being thorough and specific is crucial. The OCR expects you to provide relevant policies, procedures, your practice’s Security Risk Analysis (SRA), and other important documentation. Having this documentation readily available for your practice is essential. With only 30 days or less, you don’t have time to scramble. There isn’t an exact number of questions the OCR will ask about your practice. It all depends on what information the OCR currently has about your practice. As investigation documentation will likely span hundreds of pages, providing an index and table of contents is vital. Organize your documentation by ensuring it directly answers the specific question being asked. When compiling documentation, reference the question to maintain organization. The pages should also be numbered and match the index provided at the beginning of the response. If you have questions when organizing documentation, you can contact your investigator. Working with a third party, such as a HIPAA software solution provider or a lawyer, who has experience navigating an investigation is also recommended. Lastly, review your documentation carefully, ensuring all questions have been comprehensively answered. Then, send in the requested documentation to your HIPAA investigator with your OCR case number labeled appropriately. What’s Next? After the initial submission, the OCR might ask for additional information. That’s why answering questions thoroughly is vital to streamlining the investigation process. It could take months before the OCR responds. Once all necessary documentation is received, the OCR may close its investigation. Your practice could be found compliant or face monetary penalties and government monitoring. The need to quickly gather and organize documentation during an investigation highlights the importance of proactive document management. Easy access to documentation promotes a transparent culture of compliance within your practice. This organization also reduces stress in stressful situations, such as investigations. By utilizing an intelligent software solution, your practice can organize all documentation within the software, easily downloading and compiling all required documents for an investigation. Software solutions can also include incident response programs, providing healthcare practices with expert guidance when navigating a HIPAA investigation. To learn more about how your practice can ace an investigation, schedule a consultation with one of our experts today. To visit our first installment of this series, which is focused on the breach, please visit here, and to learn more about the audit letter, visit here. To finish the series, learn more about the potential outcomes of an investigation here.