In Brief: OCR’s Recommendations for HIPAA Covered Health Care Providers
On August 18, 2025, the Office for Civil Rights (“OCR”) announced a settlement with BST & Co. CPAs, LLP (“BST”) over alleged violations of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Security Rule. BST, a New York public accounting and consulting firm, serves as a HIPAA business associate by receiving financial data containing protected health information (“PHI”). The enforcement action brought by OCR stemmed from a ransomware attack discovered in December 2019, which impacted the PHI of BST’s covered entity client.
The HIPAA Security Rule sets forth certain national standards intended to protect the confidentiality, integrity, availability, and security of electronic protected health information (“ePHI”) by requiring administrative, physical, and technical safeguards. The HIPAA provisions include a risk analysis requirement which requires regulated organizations like BST to conduct an accurate and thorough assessment of potential risks to and vulnerabilities of ePHI. OCR’s investigation revealed that BST failed to conduct a sufficient risk analysis, a foundational requirement under the HIPAA Security Rule. To resolve the matter, BST agreed to pay $175,000 and implement a corrective action plan requiring, among other measures, a complete risk analysis, a risk management plan, revised policies and procedures, and increased workforce training.
In connection with this settlement, OCR reiterated several key recommendations for covered health care providers and other regulated entities to mitigate or prevent cyber-threats to ePHI. First, organizations should identify where ePHI resides within their systems and understand how it flows into, through, and out of their information systems. Regular and updated risk analyses are critical, and any identified risks and vulnerabilities must be addressed through targeted risk management strategies. OCR further emphasized the necessity of technical safeguards, including audit controls to monitor system activity, authentication protocols for user access, and encryption of ePHI both at rest and in transit. Beyond technical measures, OCR advises continuous review of system activity, incorporation of lessons learned from past incidents into the overall security management process, and workforce HIPAA training tailored to organizational roles and responsibilities.
To protect the confidentiality, integrity, availability, and security of ePHI, HIPAA compliance must be ongoing, systematic, and proactive. If you or your business may be affected, please contact Kessler Collins to assist you in navigating these challenges and protecting your interests.
