"For HIPAA covered entities in general, the enforcement action highlights the importance of: [1] Compliant business associate agreements with third-party administrators, other service providers, and vendors; [2] Risk analyses that include all IT equipment, applications, and data systems that use electronic PHI; [3] Procedures for terminating access to electronic PHI when employees and other workforce members stop working for an employer; [and] [4] Ongoing training for all workforce members."  MORE >>