News & Analysis as of September 11, 2025

Business Associates › Personally Identifiable Information › Data Breach

+ Follow

Business Associates can refer broadly to individuals engaged in business relationships with one another. However, in the HIPAA context, the term has a specific statutory meaning and those characterized as... more +

Business Associates can refer broadly to individuals engaged in business relationships with one another. However, in the HIPAA context, the term has a specific statutory meaning and those characterized as business associates have expanded data protection obligations and duties. Essentially, a business associate under HIPAA is a person or entity that performs certain functions or services which necessitates exposure to protected health information on behalf of a covered entity. Typical business associate functions include: claims processing or administration, data analysis, billing, etc. less -

3 Takeaways From Recent Cyberattacks On Healthcare Cos.

Troutman Pepper Locke on 9/4/2025

Significant data breaches have affected major players in the healthcare industry in the last year, with the methods of attack being as diverse as the affected entities themselves. Originally published in Law360 - June 4,...more

Data Breach Litigation Preparation: What U.S. Laws Apply to Data Breaches?

BCLP on 1/28/2020

As of January 1, 2020, California became the first state to permit residents whose personal information is exposed in a data breach to seek statutory damages between $100-$750 per incident, even in the absence of any actual...more

Report on Patient Privacy Volume 19, Number 11. Privacy Briefs: November 2019

Health Care Compliance Association (HCCA) on 11/12/2019

Report on Patient Privacy Volume 19, Number 11. (November 2019) ? The biggest threat to protected health information comes from carelessness within your organization, according to a brief from the Clearwater...more

Privacy & Cybersecurity Update - June 2019

Skadden, Arps, Slate, Meagher & Flom LLP on 7/2/2019

In this month's edition of our Privacy & Cybersecurity Update, we reflect on the GDPR's one-year anniversary while also examining the EU's new Cybersecurity Act. We also take a look at HHS' new guidance on direct liability of...more

A Modest HIPAA Settlement

Ballard Spahr LLP on 5/31/2019

The Office of Civil Rights of the Department of Health and Human Services (OCR) announced that it has entered into a settlement with a business associate that provides electronic medical records services to health care...more

Cybersecurity, Inside Jobs, Outside Jobs, and HIPAA

Sheppard Mullin Richter & Hampton LLP on 3/15/2019

According to a February 12, 2019 Press Release from Protenus, a developer of analytics for patient privacy monitoring and compliance, 15,085,302 patient records were breached in 2018 – a startling number made even more...more

Cottage Health Settles with OCR for $3M

Robinson+Cole Data Privacy + Security Insider on 2/12/2019

We previously reported that Cottage Health, a health care entity operating several hospitals in California, settled with the State of California for $2 million for a security incident that occurred in 2013. On February 7,...more

Company’s Vendor Suffers Breach, No Business Associate Agreement, $500K OCR Settlement

Sheppard Mullin Richter & Hampton LLP on 12/21/2018

A Florida staffing agency which provides physicians to hospitals and nursing homes, has agreed to a $500,000 settlement with the U.S. Department of Health and Human Services, Office for Civil Rights. The settlement comes...more

UMass Amherst Settles HIPAA Violations with OCR for $650,000

Robinson+Cole Data Privacy + Security Insider on 12/5/2016

The Office for Civil Rights (OCR) has announced that the University of Massachusetts Amherst (UMass) has agreed to settle an investigation against it as a result of a malware infection for $650,000, along with implementing a...more

HHS Publishes New Guidance on HIPAA and Cloud Computing

Stinson LLP on 10/27/2016

The U.S. Department of Health and Human Services Office for Civil Rights (OCR) has issued a new guidance regarding HIPAA compliance and the use of cloud computing solutions. The guidance is intended to assist covered entities...more

HIPAA News: HHS Getting Tough On ePHI Data Breaches

Snell & Wilmer on 8/8/2016

On August 4, 2016, the U.S. Department of Health and Human Services, Office of Civil Rights (OCR) announced a record-setting settlement with Advocate Health Care Network (Advocate) for multiple potential violations of HIPAA...more

"Privacy & Cybersecurity Update - July 2016"

Skadden, Arps, Slate, Meagher & Flom LLP on 8/3/2016

In this edition of our Privacy & Cybersecurity Update, we discuss the revised Privacy Shield and what companies should be doing to prepare for the new program, the FTC's reinstatement of its LabMD case, the European...more

Seven-Figure Settlement Reinforces Necessity of Business Associate Agreements

Saul Ewing LLP on 3/22/2016

On March 16, 2016, the U.S. Department of Health and Human Services, Office for Civil Rights (“OCR”) announced that North Memorial Health Care of Minnesota (“Memorial”) agreed to pay $1.55 million to resolve allegations that...more

Data-Harvesting Zombie Hackers, Blood-Thirsty Auditors, and Other Reasons to be Scared on Halloween

Mintz - Health Care Viewpoints on 10/30/2015

This Halloween, the scariest monsters might not be in your closet or under your bed. They may be overseas, orchestrating intrusions into your electronic medical record. Or they may be lurking in your own workforce, carrying...more

Final Rules Under HIPAA/HITECH Impact Employer Plans

Morgan Lewis on 1/28/2013

Modifications to the rules require action by group health plan sponsors and their vendors, including revisions to policies and procedures and new privacy notices. On January 17, the Office for Civil Rights of the U.S....more

Why Medical Providers Should Take Caution with Sensitive Information, Especially With Mobile Devices

Pullman & Comley, LLC on 1/22/2013

We continue to hear reports of large-scale data breaches that involve the loss or theft of thousands of records containing personally identifiable information of individuals (PII). If such a loss or theft is determined to...more

16 Results

/

View per page

Page: of 1