Advanced Care Hospitalists PL (ACH) has agreed to pay $500,000 and implement a corrective action plan to settle potential violations of the HIPAA Privacy and Security Rules.
ACH provides internal medicine physicians to hospitals and nursing homes in west central Florida, and provides services to more than 20,000 patients annually. The latest announcement from HHS details an incident where ACH shared protected health information (PHI) with an unknown vendor without a business associate agreement (BAA).
The incident occurred between November 2011 and June 2012. ACH engaged the services of an individual that claiming to be a representative of a Florida-based company named Doctor’s First Choice Billings, Inc. (First Choice). The individual provided medical billing services to ACH using First Choice’s name and website, but allegedly without any knowledge or permission of First Choice’s owner.
On February 11, 2014, a local hospital notified ACH that patient names, dates of birth, and social security numbers had been published on the First Choice website. ACH was able to identify at least 400 affected individuals and asked First Choice to remove the protected health information from its website. ACH further filed a breach report with OCR stating that an additional 8,855 patients could have been affected.
OCR’s investigation revealed that ACH did not enter into a business associate agreement (BAA) with the medical billing service, and failed to adopt any policy requiring business associate agreements until April 2014. Additionally, ACH had not conducted risk analysis or developed any written HIPAA policies or procedures before 2014.
Under the latest corrective action plan, ACH agrees to adopt of business associate agreements, conduct enterprise-wide risk analysis, and implement policies and procedures to comply with HIPAA Rules.
What Does This Violation Mean?
HIPAA violations can occur from some of the most basic issues. In this case, a single unsigned Business Associates Agreement (BAA) led to protected health information being compromised and a large fine. Organizations must have administrative policies in place and know what they mean. Setting administrative policies and standard operating procedures would have prevented the sharing of PHI with unauthorized 3rd parties.
How Can Dash Help?
Unlike many solutions which address either technical controls or administrative controls, Dash empowers users to customize and create policies then enforce those policies via continuous compliance monitoring. For this specific violation, the Dash Risk Management Policy would cover specifics on how to conduct risk analysis and address 3rd party contractors and vendors. By connecting this policy to IAM role related monitoring and the System Access Policy, Dash users can proactively set security controls and prevent this exact issue.
FAQ: Medical Billing Vendor Security and HIPAA Compliance
How should healthcare organizations verify a medical billing vendor before sharing PHI?
Verify the vendor’s legal identity, business contact information, and the representative’s authority to act on its behalf. Confirm that relationship through independently obtained contact details rather than relying only on an email signature or website. Review the vendor’s security practices and execute the required business associate agreement before providing PHI.
Is a signed BAA enough to protect patient information?
No. A BAA establishes obligations for handling PHI, but it does not verify that a vendor has implemented effective safeguards. Healthcare organizations should also evaluate relevant security risks, limit data access, use secure transfer methods, and establish incident reporting procedures. Contractual protections and operational safeguards must work together.
What should a vendor onboarding checklist include before granting access to PHI?
Include verified vendor identity, a defined service scope, a documented security review, an executed BAA where required, and approval from the responsible internal owner. Specify which data the vendor needs, how it will receive that data, and who can authorize access. Keep access disabled until the required checks are complete.
How much patient information should a medical billing vendor receive?
Provide only the PHI reasonably necessary for the billing services being performed. Define the required data fields and access permissions instead of granting unrestricted access to patient records. Review those permissions when the vendor’s responsibilities change, and remove access that is no longer needed.
What should an organization do if it discovers a vendor has no BAA?
Promptly review the relationship, identify what PHI has been shared, and restrict further disclosures while addressing the gap. If the vendor is a business associate, execute an appropriate BAA before continuing the arrangement. Assess prior disclosures and any suspected exposure separately; signing an agreement later does not retroactively resolve earlier compliance failures.
What should healthcare organizations do if a billing vendor publishes PHI online?
Act promptly to restrict public access and preserve evidence without unnecessarily copying or redistributing the exposed information. Activate the incident response process, determine which individuals and data were affected, and assess applicable notification obligations. Removing the information from the website is an initial containment step, not the end of the investigation.
What vendor records should healthcare organizations maintain?
Maintain a centralized inventory showing each vendor’s legal name, service, internal owner, PHI access, BAA status, and security review history. Retain relevant contracts, access approvals, incident contacts, and termination records. This helps teams identify missing agreements and confirm which third parties still have access to patient information.
