These questions arise from real conversations among compliance officers and IT security leads after reading about settlement announcements. The Boston Children's Health Physicians (BCHP) and XTIUM case, which resulted in a $2.7 million penalty following a breach affecting nearly 890,000 individuals, highlights issues relevant to most covered entities and business associates managing vendor relationships.
You're likely asking some version of these questions right now.
Q1: We use a managed service provider for IT support. Are we on the hook if they get breached?
Yes, and the BCHP case proves it.
BCHP hired XTIUM (formerly Axispoint Technology Solutions Group) to manage certain IT systems. When attackers exploited XTIUM's remote access tool and exfiltrated unencrypted patient billing records, both entities paid penalties: $2.1 million to New York and $540,000 to Connecticut, with an additional $1.3 million suspended.
Under the HIPAA Security Rule, you're responsible for Protected Health Information (PHI) even when a Business Associate handles it. Your business associate agreement doesn't transfer liability; it establishes mutual obligations.
Here's what you need:
- A current, signed business associate agreement specifying security responsibilities
- Regular vendor security assessments (not just at contract signing)
- Documented evidence that you've reviewed their security posture
- Clear incident response protocols, including notification timelines
If your vendor gets breached and you can't demonstrate you performed reasonable due diligence, OCR or state attorneys general will hold you accountable.
Q2: Our vendor says they handle security. Do we still need to audit them?
Absolutely. BCHP learned this the hard way.
XTIUM was responsible for managing IT systems but not security functions. BCHP failed to enforce security policies, and XTIUM didn't request them. XTIUM used a single shared administrative account with unrestricted access and unlimited privileges across BCHP's entire system.
Your vendor assessment should verify:
- Multi-factor authentication on all administrative accounts
- Role-based access controls and the principle of least privilege
- Network segmentation between client environments
- Logging and monitoring capabilities for privileged access
- Patch management procedures and timelines
- Encryption standards for data at rest and in transit
Don't accept "we handle security" as an answer. Request evidence. Review audit reports. If your vendor has SOC 2 Type II or HITRUST CSF certification, examine the scope. Does it cover the specific services they're providing you?
Q3: We had a security audit last year that flagged some issues. How urgent is remediation?
Extremely urgent, and you need documentation showing you're addressing findings.
BCHP underwent a third-party information security audit in 2023 that identified security gaps. They didn't act on the findings. For two years before the breach, executives knew an archive containing over 1 million billing records wasn't encrypted. That unencrypted data was exfiltrated in the attack.
When regulators investigate a breach, they look for patterns of negligence. An ignored audit report is evidence you knew about vulnerabilities and chose not to fix them. That transforms a security incident into willful neglect, which carries significantly higher penalties.
Create a remediation plan within 30 days of receiving audit findings:
- Prioritize based on risk (unencrypted PHI, unrestricted admin access, missing logging)
- Assign owners and deadlines for each finding
- Document interim compensating controls if you can't immediately remediate
- Track progress in writing and report to leadership monthly
If you can't remediate immediately, document why and what temporary safeguards you've implemented. That documentation matters during investigations.
Q4: What's the minimum logging we need to detect and investigate an incident?
The BCHP breach investigation couldn't determine exactly how attackers gained initial access because logging and monitoring were insufficient. That prevented meaningful analysis and likely extended the breach timeline.
At minimum, you need:
- Authentication logs (successful and failed login attempts) for all systems containing PHI
- Privileged account activity logs (what admins do with elevated access)
- Remote access logs (who connected from where and when)
- Data access and export logs (who accessed PHI and whether they downloaded it)
- System configuration change logs (who modified security settings)
Retention matters too. The HIPAA Security Rule doesn't specify a timeframe, but you need enough history to investigate. Most organizations retain security logs for at least one year, with critical system logs kept longer.
Configure alerts for suspicious patterns: after-hours access, multiple failed login attempts, privilege escalation, large data exports, or configuration changes outside maintenance windows.
Q5: We discovered unauthorized access. How fast do we need to act?
Immediately, and your response timeline will be scrutinized.
XTIUM notified BCHP about the incident on September 6, 2024. BCHP reset user passwords on September 7 but didn't reset system or administrator passwords and didn't isolate systems from the internet. They didn't identify unauthorized activity in their own network until September 10 and didn't isolate systems until then.
That three-day gap between notification and isolation gave attackers time to compromise four additional unrestricted administrative accounts and access BCHP's entire system.
Your incident response plan should trigger these actions within hours, not days:
- Isolate affected systems from the network
- Reset all credentials (users, administrators, service accounts, API keys)
- Preserve forensic evidence before remediation
- Engage your incident response team and legal counsel
- Document every action with timestamps
The Breach Notification Rule requires notification within 60 days of discovery, but your response actions need to happen immediately to contain the incident and preserve evidence.
Q6: Can we get credit for having some security measures in place?
Not really. Partial compliance doesn't reduce liability.
BCHP had one managed service provider handling their active patient record system, which wasn't affected. But the second provider's security failures exposed billing records for approximately 825,000 New York residents and 62,871 Connecticut residents, including Social Security numbers and driver's license numbers for approximately 170,000 New York residents.
Regulators evaluate whether you implemented reasonable safeguards across all systems containing PHI. Security gaps in one area don't get offset by controls in another.
The HIPAA Security Rule requires you to:
- Conduct regular risk analyses that identify where PHI exists
- Implement security measures appropriate to the risk
- Document your decisions about Addressable Specifications
- Review and update safeguards as technology and threats evolve
"We secured some systems" won't satisfy OCR. You need a comprehensive, documented security program that addresses all locations where PHI exists.
Where to Go for More
Start with NIST SP 800-66, which provides implementation guidance for the HIPAA Security Rule. It walks through each standard and offers practical approaches.
For vendor management, review your business associate agreements against HHS model contract language. If your agreements don't specify security requirements, incident notification timelines, and audit rights, update them.
If you've received audit findings you haven't addressed, create a remediation plan this week. Document what you're doing, when you'll complete it, and any interim controls. That documentation is your evidence of reasonable effort.
The BCHP settlement agreement, available through the New York Attorney General's office, details the security measures both entities must now implement. Use it as a checklist for your own program.
