Missing Risk Analysis Cost NY CPA Firm $175K—But Not the Big Group Whose Data Was Breached in 2019

The DataBreaches[.]net piece reports that the U.S. Department of Health and Human Services’ Office for Civil Rights imposed a $175,000 HIPAA enforcement action, notable for focusing on a business associate rather than a covered entity. According to HHS Office for Civil Rights (OCR) HIPAA enforcement action, the BA in question is an accounting firm, BST & Co. CPAs LLP, whose protected health information was breached in 2019.

The settlement is framed as part of OCR’s Risk Analysis Initiative, and the article notes that ransomware has figured in at least 15 of the ten enforcement actions to date. Community Care Physicians (CCP) of New York is described as having offered only praise for BST & Co. CPAs LLP, despite the breach and the related obligations.

The piece also highlights the unusual nature of a BA being named in OCR enforcement and underscores the ongoing lessons about breach readiness in an era when many expect a breach to occur rather than if. Read more at JDSupra, with the original report appearing in Report on Patient Privacy 25, no. 9 (September, 2025).