According to the FBI in its 2025 IC3 Annual Report, the healthcare industry ranked as the top targeted sector for cyber threats that year, with 460 known ransomware attacks and 182 data breaches. Cybercriminals target healthcare because patients’ PHI is central to proper patient care. A single compromise can cause a long list of issues for a healthcare organization, and unfortunately, the healthcare industry has numerous threat vectors prime for an attack.

Hackers know that disabling a health network can make it difficult for healthcare organizations to properly treat patients. That’s why it's not unheard of for covered entities to pay ransoms to have their systems restored, even though there are indications that organizations making ransom payments are changing.

Financial gain remains the primary motivation behind healthcare data theft because of the opportunity for multiple forms of fraud. Criminal marketplace pricing clearly demonstrates the demand: a driver’s license reportedly sells for about $20, while a complete identity package can sell for $1,000. Stolen PHI can be used for identity theft and to impersonate patients needing medical services.

 

What is a business associate?

The Health Insurance Portability and Accountability Act (HIPAA) sets national standards that safeguard the privacy and security of PHI. Compliance with the HIPAA Act is a legal requirement that protects patients’ privacy and ultimately lets providers focus on patient care. The legislation applies to healthcare organizations as well as their business associates (also called vendors).

According to the U.S. Department of Health & Human Services (HHS), a business associate is a person or entity that performs certain functions or activities that involve the use or disclosure of PHI for a covered entity. The department further states that “the Privacy Rule allows covered providers and health plans to disclose [PHI] to these ‘business associates’ if the providers or plans obtain satisfactory assurances that the business associate will use the information only for the purposes for which it was engaged by the covered entity, will safeguard the information from misuse, and will help the covered entity comply with some of the covered entity’s duties under the Privacy Rule.”

Business associates must implement strong privacy and security measures, recognizing their direct obligation to adhere to HIPAA and the potential consequences associated with noncompliance.

 

Business associates in 2026

Healthcare business associates are following the same trends as other companies, adopting advanced technologies to further protect themselves and the healthcare companies that employ them. Such modernization has occurred over the past few years due to changes in technologies, financial pressures, workforce transformations and growing issues, and new cyber risks. Accordingly, business associates can modernize by utilizing:

  • AI integration
  • Vendor consolidation
  • Enhanced supply chain visibility (i.e., transparency)
  • Cybersecurity included in contracts
  • Automation
  • Stronger third-party risk management
  • Advanced digital procurement strategies

It should be noted that the HIPAA Security Rule is undergoing a rewrite due to such changes in technology and how healthcare entities use them. For example, once enacted, both healthcare providers and business associates will be required to maintain and annually update a technology asset inventory and network map, conduct detailed security risk analyses tied to those inventories, and enforce access controls.

Accordingly, the rule imposes new verification requirements on business associates, making them directly liable for HIPAA violations, requiring them to confirm adherence to safeguards and contingency plans.

 

Business associate attacks in 2026

In 2026, advanced cyberattacks against business associates have surged as criminal groups shift focus from direct hospitals to vulnerable software, billing, and medical technology supply chains. Omega Systems’ 2026 Healthcare IT Landscape Report found that 85% of healthcare organizations experienced at least one third-party or “vendor-of-a-vendor” disruption in the past year (of those surveyed, the report also found that 63% of providers do not continuously monitor digital supply chains).

A recent article further added that “the number of reported AI-enabled cyber attacks rose by 47% globally in 2025,” also noting that “healthcare, a critical sector, saw a 76% rise in targeted AI attacks in 2025, largely attributed to the automation of ransomware deployment.” Artificial intelligence helps hackers take advantage of unsecured systems and untrained staff to target healthcare organizations for cyber fraud.

The result of the increase in business associate threats and advanced risks is a lack of cybersecurity confidence. Furthermore, healthcare organizations remain accountable for many failures of business associates. Given how rapidly such attacks can occur against multiple vendors, traditional cybersecurity can easily fail. The HIPAA Act is designed to protect patients’ PHI and keep confidential data from being disclosed without a patient’s consent or knowledge.

 

The impact of business associate breaches on healthcare staff

Business associate attacks impact healthcare staff as much as patients. They disrupt daily clinical workflows, expose staff credentials, and increase workload burdens. If access to electronic health records is interrupted, staff may not have the information they need to make accurate health decisions, affecting patient care. The disruption forces staff to rely on manual processes, increasing stress, fatigue, cognitive load, and the risk of mistakes and can go even further.

For one thing, cybercriminals could conduct account takeover attacks using stolen credentials to access staff email and intranets. Hackers can commit financial fraud, use compromised accounts to launch further attacks, or perform identity theft. Identity theft is an active, deliberate act carried out by cybercriminals. Direct consequences to staff could include damaged credit, drained bank accounts, tax complications, and sometimes months or years of effort to restore their name and financial standing.

The result of the increase in business associate threats is a lack of confidence in an organization’s staff. Given how rapidly such attacks can occur against multiple business associates, traditional cybersecurity can easily fail, ultimately putting a huge burden on staff.

Related: Human error is inevitable – robust email security is a must

 

Cybersecurity strategies for business associate HIPAA compliance

HIPAA requires healthcare organizations and business associates to implement specific security measures when using technology to receive, transmit, or store PHI. Business associates can use numerous effective tactics when creating a layered, consolidated security system.

  1. Establishing up-to-date policies and procedures
  2. Keeping systems, software, and security features aligned with advanced technologies
  3. Keeping covered entities informed of issues and updates
  4. Using continuous employee awareness training about PHI and HIPAA
  5. Ensuring proper technological safeguards, such as data encryption
  6. Employing extra firewalls and endpoint security
  7. Utilizing strong access controls
  8. Keeping devices (physically) in secure, controlled locations
  9. Creating data backup and disaster recovery plans in case of an incident
  10. Regularly auditing and monitoring systems
  11. Having an incident response plan ready in case it is needed

HIPAA compliance regulations aim to protect health information. Adhering to HIPAA standards with a defensive approach helps business associates (and providers) protect privacy, leading to stronger systems and better patient outcomes.

See also: What should be in a healthcare AI vendor security review

 

Best practices for working with business associates in 2026

The key to finding a HIPAA compliant business associate in 2026 is to carefully examine the company’s activities and how it protects PHI. Healthcare providers should evaluate a business associate’s security certifications, compliance history, data protection measures, incident response capabilities, and training agendas. Moreover, they should look for business associates that:

  1. Sign an updated BAA and mention HIPAA compliance
  2. Provide written verification at least annually of technical safeguards (2027 update)
  3. Utilize security measures that comply with HIPAA’s technical, physical, and administrative safeguards
  4. Understand and can answer questions about HIPAA
  5. Have HIPAA-related policies and procedures available
  6. Provide reviews, testimonials, and case studies from other healthcare organizations
  7. Deliver staff training on HIPAA and PHI security
  8. Conduct comprehensive risk analyses
  9. Continuously update their security based on new laws and new attack methods

If a business associate refuses to do any of the above, a healthcare organization should find an alternative, HIPAA compliant solution. Sharing PHI with a business associate that does not demonstrate compliance puts an organization at risk of breaches, HIPAA violations, fines, and tired, overstressed staff.

 

Protecting business associate email communication

Email offers a quick and convenient way for healthcare professionals to communicate with their business associates. However, it can also lead to concerns around keeping private information secure. Under the HIPAA Privacy Rule, healthcare organizations must provide employees with HIPAA compliance training on “privacy policies and procedures, as necessary and appropriate for them to carry out their functions.” This includes using email.

Paubox Email Suite is a HIPAA compliant email solution designed for healthcare organizations to securely communicate PHI without disrupting workflow. It seamlessly encrypts all outbound emails, delivering them directly to recipients’ inboxes. Paubox integrates with existing email platforms like Google Workspace and Microsoft 365, ensuring seamless security while maintaining ease of use.

Its generative artificial intelligence (AI) offers a secure email solution for organizations seeking a cybersecurity option tailored to one of their most vulnerable outputs. Traditional filters often miss messages that appear normal, so attackers slip through. Finally, Paubox’s Inbound Email Security is designed to plug those gaps by combining AI, pattern recognition, and domain protections.

More about: HIPAA compliant email: The definitive guide (2026 update)

 

FAQs

Are business associates directly liable under HIPAA?

Yes. HHS’ Office for Civil Rights explains that business associates are directly liable for certain HIPAA violations.

 

Can a covered entity use a vendor without a BAA?

No, not when the vendor is acting as a business associate. Guidance says covered entities and business associates must enter into HIPAA compliant business associate contracts with vendors that create, receive, maintain, or transmit PHI on their behalf.

 

Does a business associate need agreements with its subcontractors?

Yes. A business associate must ensure that subcontractors with access to protected health information agree to the same restrictions and conditions that apply to the business associate.

 

How must a business associate secure PHI?

Business associates must implement a multifaceted approach with physical, administrative, and technical safeguards to secure PHI:

  • Physical safeguards involve controlling physical access to data storage
  • Administrative safeguards include robust policies and procedures
  • Technical safeguards employ encryption, access controls, and secure technologies to prevent unauthorized access or disclosure

 

What rights do patients have regarding business associates handling their PHI?

Patients retain significant rights concerning their PHI. These rights include accessing their information, requesting amendments, and filing complaints if they believe their privacy rights have been violated by business associates. Business associates must respect and safeguard these rights.

 

Which employees are most commonly targeted in business email compromise attacks?

Finance teams, executives, HR departments, and procurement staff are frequent targets because they often handle payments, payroll, and sensitive documents.