HIPAA Security Risk Analysis

• Abyde HIPAA portal responses and documentation

• Vendor service agreements and performance analysis

• System configuration reviews and security assessments

• Staff interviews and operational procedure evaluation

• Interviews and surveys of the IT provider, VP Systems

Violations Found:

• Failure to conduct required security risk assessments

• Failure to implement system activity review procedures

• Inadequate access controls and safeguards

• Insufficient documentation of security measures

Violations Found:

• Failing to implement proper access authorization policies

• Failing to reduce risks and vulnerabilities to reasonable and appropriate levels

• Failure to regularly review information system activity

• Inadequate audit controls and monitoring

Violations Found:

• HIPAA Right of Access violation

• Failure to provide timely access to patient records

• Inadequate documentation of access request handling

• Inadequate audit controls and monitoring

Relevance to Concierge Care: While this case focused on patient access rights rather than technical safeguars, it demonstrates that even single-category violations result in substantial penalties. The $60,000 settlement represents the lower bound of enforcement exposure and shows that OCR actively investigates and penalizes Florida healthcare providers.

1. Documented knowledge of gaps: This risk assessment identifies specific violations
1.

1. Continued operation of non-compliant systems: Call recording system operates with known HIPAA violations
2.

1. Delayed vendor remediation: VP Systems failures documented but contract continues
3.

1. Technical safeguard gaps: Awareness of MDM requirements without implementation
4.

• Refusal to provide required security documentation despite BAA Section 8(a) obligations requiring access to policies, procedures, and records

• Inconsistent service delivery compared to contracted obligations under MSA

• False attestations in compliance portal followed by service denial when documentation was requested

• Document fraud and professional misconduct by vendor leadership, including fabrication of prior BAA and false fraud accusations

• Inadequate HIPAA knowledge demonstrated through fundamental compliance errors

• Breach notification failure: VP Systems identified PHI in service tickets as a deficiency in their own SRA but failed to notify Concierge Care of this breach, failed to quantify the number of affected records, failed to explain how PHI entered the ticketing system, and failed to enable corrective action

• Incomplete asset management: VP Systems has failed to provide a current, detailed asset inventory despite multiple requests, preventing accurate security assessments

• Copier/printer security gaps: VP Systems cannot provide documentation on copier hard drive encryption, secure destruction policies, or current security status of multifunction devices that may store PHI

• Inadequate audit log retention: Firewall logs are only retained for 30 days, falling short of HIPAA requirements for sufficient retention to support incident investigation and compliance audits

• Failure to address communication platform sprawl: Multiple unmanaged communication platforms (text messaging, 3CX Messenger, email, Wellsky messaging) create inconsistent security controls and audit gaps across locations

• No Mobile Device Management (MDM) implementation despite HIPAA requirements

• 36+ users accessing PHI on unmanaged personal devices

• Lack of device encryption verification and remote wipe capabilities

• Insufficient application controls and data segregation

• Missing device compliance monitoring and policy enforcement

• Shared WiFi network between staff and visitors (ConciergeCare/He@lthc@re)

• No guest network isolation from PHI-containing systems

• Insufficient network monitoring and access logging

• Inadequate VPN controls and user authentication

• Missing advanced network security and threat detection capabilities

• Legacy network infrastructure without modern security controls

• Inadequate audit log generation and review procedures

• Missing automated monitoring for suspicious PHI access

• Insufficient documentation of system activity reviews

• Lack of comprehensive incident detection and response capabilities

• Inadequate vendor monitoring and oversight procedures

• Inconsistent alarm systems: Some locations have alarm systems while most do not, creating uneven protection of PHI-containing areas

• Shared alarm codes: Locations with alarms share codes among all staff, eliminating individual accountability and audit trails

• No alarm code management: No documented alarm code changes or periodic testing, allowing indefinite access for terminated employees

• Fire safety system gaps: Discrepancies in fire safety systems across locations with some unable to identify the date of most recent fire marshal inspection

• Key management failures: Most locations issue physical keys to employees with limited or no logging of key returns upon termination

• No verification of BitLocker encryption on managed devices

• Insufficient encryption key management and documentation

• Inadequate backup encryption and security verification

• Missing data loss prevention (DLP) controls

• Unverified encryption for PHI transmission and storage

• No Business Associate Agreement: CallRail Basic (current system) explicitly disclaims HIPAA responsibility and does not provide a Business Associate Agreement, violating § 164.308(b)(1) requirement for BAAs with vendors storing ePHI

• No Encryption: Recordings containing PHI are stored without encryption at rest on CallRail servers, violating § 164.312(a)(2)(iv) and § 164.312(e)(2)(ii) encryption requirements

• No Access Controls: No documented access controls, unique user IDs, or role-based permissions for who can access recorded PHI, violating § 164.312(a)(1) access control requirements

• No Audit Trails: No audit logs showing who accessed, downloaded, or listened to recordings containing PHI, violating § 164.312(b) audit control requirements

• No Retention/Destruction Policy: Recordings accumulate indefinitely without documented retention schedule or secure destruction procedures, violating § 164.530(j) documentation requirements

• Platform: CallRail HIPAA-compliant version with Business Associate Agreement

• Consent Workflow: Explicit two-party consent mechanism with opt-in/opt-out capability and documented proof of consent for each call

• Encryption: All recordings encrypted at rest and in transit

• Access Controls: Role-based access with unique user IDs and authentication

• Cost: Approximately $8,000 annually

• Result: Full HIPAA compliance and Florida two-party consent law compliance

• Platform: CallRail Basic (non-HIPAA version)

• Consent Mechanism: Simple disclaimer only ("this call may be recorded")

• Encryption: None at rest; recordings stored in plain form on CallRail servers

• Access Controls: Not documented or restricted

• Audit Trails: None

• BAA: CallRail Basic explicitly disclaims HIPAA responsibility

• Result: Direct HIPAA violations; approximately 31,000+ calls recorded annually without required safeguards

• Willful neglect (not corrected): $50,000 per violation, up to $1.5 million annually per violation category

• Estimated annual exposure: With 31,000+ recorded calls containing PHI and multiple violation categories, potential HIPAA penalties could reach $1.5 million+ annually

• On-premises Exchange server without advanced threat protection

• Inadequate email encryption and data loss prevention capabilities

• Missing a secure collaboration platform for PHI-containing documents

• Insufficient email archiving and retention compliance

• Lack of advanced security features for email-based PHI transmission

• Unable to apply conditional access for remote email authentication

• Concierge Care is paying for former staff email accounts each month

• Email system does not provide conditional access policies to prevent unauthorized use

• Email encryption is currently limited to only a small number of users

• Email is missing required multi-factor authentication

• Insufficient vendor security assessments and ongoing monitoring

• Missing comprehensive Business Associate Agreement enforcement

• Inadequate vendor incident notification and response procedures

• Insufficient documentation of vendor security controls and capabilities

• Missing vendor performance monitoring and compliance verification

• Missing Confidentiality Agreements for other vendors that may see PHI

• Wellsky's HITRUST certification does not appear to be accurate

• Wellsky failed to provide timely security documentation despite multiple requests

• Wellsky does not require a password for caregivers to access PHI

• Wellsky does not support multi-factor authentication

• No security awareness training program: Staff have not received training on identifying and responding to security threats such as phishing, social engineering, malware, or ransomware attacks

• No phishing simulation or testing: No program to test staff ability to recognize and report phishing attempts, which are the leading cause of healthcare data breaches

• No ongoing security education: No regular security updates, newsletters, or refresher training to maintain security awareness

• No role-based security training: Staff in high-risk roles (billing, HR, clinical) have not received specialized training on protecting PHI in their specific functions

• No multi-factor authentication (MFA/2FA): Email systems, EHR access, and other systems containing PHI lack two-factor authentication, allowing unauthorized access if passwords are compromised

• No password management system: Staff lack enterprise password managers, leading to weak passwords, password reuse across systems, and insecure password storage

• No password complexity enforcement: Systems may lack adequate password policies requiring length, complexity, and regular rotation

• No single sign-on (SSO): Multiple system logins increase password fatigue and security risks

• Phishing Attacks: 90% of healthcare data breaches begin with phishing emails

• Ransomware: Healthcare sector is #1 target for ransomware attacks

• Credential Compromise: 81% of data breaches involve weak or stolen passwords