Many people think any mention of health information violates HIPAA. That's not how it works. Your mom can post on Facebook as much as she wants about that one time the doctor helped you with that embarrassing thing because HIPAA applies to healthcare providers, health plans, and the businesses that handle health information on their behalf. Now, if your doctor posted the same thing, that would be a HIPAA violation.
A New York CPA firm just paid $175,000 to settle a HIPAA investigation, and its case shows exactly how a business outside healthcare ends up on the hook for healthcare privacy law.1
HIPAA reaches covered entities and the businesses that serve them
Covered entities are the obvious ones: health plans, healthcare clearinghouses, and the healthcare providers (hospitals, doctors, and the like) that conduct the standard electronic transactions HIPAA regulates.2
Business associates are less obvious. When you create, receive, maintain, or transmit protected health information (PHI) on behalf of a covered entity, you become a business associate, and much of HIPAA, including the Security Rule, applies to you directly.3 A subcontractor that handles PHI for a business associate is also a business associate.
Nobody else is covered. You, your mom, your neighbor, and that random guy on LinkedIn can talk about your health all they want. It may not be kind, and there may be a real question about who broke HIPAA to give them the information in the first place. But they aren't covered by it.
An accounting firm became a business associate by doing its job
BST & Co. CPAs provided accounting services to Community Care Physicians, and the financial information it handled contained PHI. That made BST a business associate, subject to HIPAA's security requirements.
The definition doesn't care what industry you're in. It turns on what you do with PHI for a covered entity. The regulation lists functions like claims processing, data analysis, utilization review, quality assurance, and billing, as well as services like legal, actuarial, accounting, consulting, management, administrative, and financial services.4 An accounting firm working with a medical practice's financial records fits squarely within it.
BST knew its obligations and skipped the risk analysis anyway
BST knew it was a business associate. It had to, because Community Care required specific terms in its contract.5 BST reported the breach to the Office for Civil Rights (OCR).
On December 7, 2019, BST discovered ransomware on its network. The breach exposed PHI belonging to about 170,000 people. OCR's investigation found that BST had never conducted an accurate and thorough risk analysis of the potential risks and vulnerabilities to the PHI it held.6 That analysis is a foundational requirement of the Security Rule.
The settlement spells out what BST should have been doing all along
The settlement requires BST to follow a corrective action plan for two years. It must complete a risk analysis that maps where PHI lives in its systems and identifies vulnerabilities, and update it at least annually and whenever its systems change. It must adopt a risk management plan that addresses those vulnerabilities on a timeline, write policies that match how the firm actually operates, train staff on their specific responsibilities, and review system activity, audit logs, and security incidents on an ongoing basis.7
OCR's announcement also included recommendations that apply to anyone handling PHI. Know how PHI enters, moves through, and leaves your systems. Revisit your risk analysis periodically and document how you address the risks you find. Record and review system activity, verify who is accessing PHI, encrypt it in transit and at rest where appropriate, fold lessons from incidents back into your security program, and train your workforce on their actual duties.8
Ask the HIPAA questions before you sign the healthcare client
If you're considering work for a healthcare provider, find out what you're taking on before you sign the contract. Will you handle information that identifies patients and relates to their health, treatment, or payment? Does the provider have a business associate agreement ready? Do you have the administrative and technical safeguards HIPAA requires, and can you conduct and maintain the required risk analysis? The requirements are extensive, and OCR expects business associates to know what they are doing.
According to OCR, this was its fifteenth ransomware enforcement action and its tenth under its risk analysis initiative.9 BST's settlement shows that knowing you're subject to HIPAA isn't enough. If you're already a business associate, the work has to actually be done. If you're thinking about becoming one, price that work into the engagement before you say yes.
This post does not constitute legal advice. Readers should consult competent legal counsel before taking action based on the analysis presented here.
Footnotes
- U.S. Dep't of Health & Human Servs., Office for Civil Rights, HHS' Office for Civil Rights Settles HIPAA Ransomware Security Rule Investigation with BST & Co. CPAs, LLP (Aug. 18, 2025), https://www.hhs.gov/press-room/hhs-ocr-bst-hipaa-settlement.html. ↩︎
- 45 C.F.R. § 160.103 (definitions of "covered entity" and "health care provider"), https://www.law.cornell.edu/cfr/text/45/160.103. ↩︎
- Id. (definition of "business associate"); 45 C.F.R. § 164.302, https://www.law.cornell.edu/cfr/text/45/164.302. ↩︎
- 45 C.F.R. § 160.103 (definition of "business associate"). ↩︎
- 45 C.F.R. § 164.504(e), https://www.law.cornell.edu/cfr/text/45/164.504. ↩︎
- Office for Civil Rights, supra note 1; see 45 C.F.R. § 164.308(a)(1)(ii)(A). ↩︎
- Office for Civil Rights, supra note 1. ↩︎
- Id. ↩︎
- Id. ↩︎
Comments
Leave a comment