Firms outside healthcare are often business associates without realizing it, for example a law or accounting firm that receives medical records for a client. A business associate agreement makes the obligations explicit, and a breach of unsecured ePHI triggers notice to affected individuals within 60 days of discovery.
The articles below cover the risk analysis, business associate obligations and the evidence HHS expects.
OCR's Risk Analysis Initiative keeps producing HIPAA settlements, including with business associates and employer health plans. What the HIPAA risk analysis (often called a HIPAA security risk assessment) requires, what OCR expects to see, and how to check yours this quarter.
You cannot patch, encrypt or back up a device you do not know exists. Here is what CIS Controls 1 and 2 require, which safeguards a small firm needs first, and how to build an inventory that holds up in front of an insurer or regulator.
The HIPAA Security Rule overhaul is still a proposed rule, with final action now listed for July 2027. What it would change, what the current rule already requires, and what business associates can do now.
Questions and answers
It can. A firm that creates, receives, stores or transmits protected health information on behalf of a covered entity, such as a law or accounting firm handling medical records for a client, is a business associate and must follow the HIPAA Security Rule.
Yes. The Security Rule's risk analysis requirement at 45 CFR 164.308(a)(1)(ii)(A) applies to business associates directly, so a law firm, accounting firm or IT provider holding ePHI for a client must assess the risks to that ePHI on its own systems. OCR has settled Risk Analysis Initiative cases with business associates, including an accounting firm in August 2025.
Encryption is an addressable specification today. That means a covered entity or business associate must assess whether it is reasonable and appropriate, then implement it or document why not and use an equivalent alternative if reasonable. The 2025 proposed rule would make encryption of ePHI at rest and in transit required, with limited exceptions.
Usually not. OCR's April 2018 cybersecurity newsletter explained that a gap analysis, which compares existing controls to a list of requirements, does not include the elements of a risk analysis and may not satisfy the obligation. A compliant risk analysis identifies where ePHI lives, the threats and vulnerabilities it faces, their likelihood and impact, and an assigned risk level with corrective actions.
The Security Rule does not set a fixed schedule. It requires the risk analysis to be reviewed and updated periodically and whenever the environment changes. Most organizations update it at least once a year.
No date is fixed. HHS published the proposed rule on January 6, 2025, and the federal regulatory agenda lists final action for July 2027 as a long-term item. An earlier target of May 2026 passed. Until a final rule is published, the current Security Rule applies and OCR enforces it.
One question to ask yourself
In 30 minutes, we talk through your setup and you leave knowing which plan fits.
Book a callSee exactly what you'd receive each quarter, by email.
Get the sample Posture Report by email