BST & CO. CPAS, LLP

HHS OCR settled a HIPAA Security Rule investigation with BST & Co. CPAs, LLP regarding a ransomware incident. BST failed to conduct a required risk analysis for ePHI it held from Community Care Physicians. The breach affected 170,000 individuals. BST agreed to pay $175,000 and implement a Corrective Action Plan including risk analysis, risk management plan, policies, and training.

BST & Co. CPAs, LLP reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2020-02-25. 14 Massachusetts residents were affected. The report records the breach type as electronic.

BST & Co. CPAs, LLP, a New York public accounting and management consulting firm acting as a HIPAA business associate, reported to HHS OCR on 2020-02-16 a Hacking/IT Incident affecting 170,000 individuals. On December 7, 2019, BST discovered part of its network was infected with ransomware, impacting PHI of its covered entity client stored on a Network Server. OCR found BST failed to conduct an adequate risk analysis. BST settled for $175,000 and entered a two-year corrective action plan.

BST & Co., CPAs, LLP notified patients of Community Care Physicians, P.C. of a data incident where a virus infected BST's network from Dec 4-7, 2019. The virus encrypted files. BST engaged forensic investigators. PHI and basic identity info may have been accessed. No SSN or medical records were impacted. One year of Equifax identity monitoring is offered.

Insero & Co., CPAs, LLP reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2019-12-10. 1 Massachusetts residents were affected. The report records the breach type as electronic.