Looking for a Business Associate Agreement? Download our FREE starter template.
Total HIPAA Logo

Guest Blog: Meet the HIPAA Police

This is another great guest blog from our friends at GRA Benefits:

The HIPAA police, a.k.a. the Department of Health and Human Services (HHS), are happy to meet you if you do any one or more of the following things:

  1. Do not encrypt your email
  2. Let a hacker access your customer database
  3. Leave completed client forms in a dumpster
  4. Share PHI with a subcontractor without an agreement
  5. Fail a carrier audit

If the HIPAA police do show up at your office. They will come with gifts – a fine for $100-$1.5 million and maybe even a warrant for your arrest. They will also post about you on their website, free publicity!

Odds are, you don’t want to meet the HIPAA police. Here are some tips to avoid them:

  1. Encrypt your email. While you’re at it, encrypt all your data-at-rest too. If you send an encrypted email to the wrong person, you could prevent the incident from becoming a breach.
  2. Set up a secure firewall, malware security software, and strong passwords. Adding multiple layers of security will further protect your information from a hacker attempting to access it.
  3. Shred it! Any type of media, including paper and electronic devices, should be properly destroyed. Client forms and other paper should be shredded. Old hard drives and computer equipment should be properly cleared or destroyed.
  4. Issue Business Associate Agreements (BAA) with any downstream entities that handle PHI on your behalf. This includes your IT vendor, shredding company, cleaning company, or possibly your building owner. The basic rule is if they have access to the information, you should have a BAA with them.
  5. Pass your carrier audit by conducting a risk analysis. Carriers are required to be aware of their business associates’ compliance standing, therefore many carriers are performing audits. If you fail, they could dissolve your contract and report you to HHS. Conducting a risk analysis will make the carrier audit process simple.


A risk analysis can be overwhelming and time-consuming. Hiring an outside vendor, such as GRA Benefits Group, makes the process quick and pain-free.

By: Bridgette O’Connor

Sharing is caring!


Looking for a Business Associate Agreement?

Download our free template to get started on your path toward HIPAA compliance.

Download Now

Let's keep in touch

Stay up to date on the latest HIPAA news, plus receive tons of free tools and info.

Navigating HIPAA Compliance in 2023

Watch the recording of this webinar to learn more about how you can become and stay HIPAA compliant!


Related Posts

What is Access Control in terms of HIPAA?

What is Access Control in terms of HIPAA?

Access control, in terms of cybersecurity, refers to the practice of managing and regulating who can access specific resources, systems, or data within an organization's network or information...

Comparing HIPAA and NIST

Comparing HIPAA and NIST

In the ever-evolving landscape of data security and privacy, two key frameworks have emerged as significant players: HIPAA and NIST. Both emphasize the importance of safeguarding sensitive...

Save & Share Cart
Your Shopping Cart will be saved and you'll be given a link. You, or anyone with the link, can use it to retrieve your Cart at any time.
Back Save & Share Cart
Your Shopping Cart will be saved with Product pictures and information, and Cart Totals. Then send it to yourself, or a friend, with a link to retrieve it at any time.
Your cart email sent successfully :)