"[1] Determine if your organization receives, maintains, or transmits PHI.... [2] Don't rely solely on TPA's policies.... [3] Designate a HIPAA Compliance Officer.... [4] Implement policies on uses and disclosures of PHI.... [5] Maintain a Notice of Privacy Practices (NPP) for your plan participants.... [6] Comply with the Security Rule and stay tuned for updates.... [7] Implement a business associate agreement (BAA) when required.... [8] Follow breach notification rules.... [9] Ensure ERISA fiduciary and cybersecurity oversight."  MORE >>