BST & Co. CPAs was a HIPAA business associate because of the health records it received, and here is how to check whether HIPAA touches your firm.
Most accounting principals file HIPAA under healthcare, something that belongs to clinics and hospitals. Then ransomware arrives, and if any of your clients are health care organizations, the people asking questions may include a regulator you did not expect. It is far better to check that before an incident than after one.
What happened at BST
BST & Co. CPAs, LLP is a HIPAA business associate because it receives financial records containing protected health information from a covered entity client. It found ransomware on its network on December 7, 2019, and filed a breach report on February 16, 2020. The HHS Office for Civil Rights (OCR) determined that BST had failed to conduct an accurate and thorough risk analysis.
BST paid OCR $175,000 and agreed to a two-year corrective action plan, which also requires an accurate risk analysis and a risk management plan. OCR announced the settlement on August 18, 2025. The ransomware was found in 2019 and the resolution came in 2025, which shows how long these matters can stay alive.
What it means for a financial firm
The lesson is that a financial firm can fall under HIPAA as a business associate when it handles health client records. Not every CPA firm is one, and it turns on what you actually receive from covered entity clients. Twenty years of auditing have taught me that those answers depend on specific facts, so please settle the legal question with your attorney, since this is a description of one settlement and not legal advice.
It is also worth noticing the second document. A risk analysis lists what could go wrong, while a risk management plan records what you decided to do about each risk, and the work is not finished until the second exists. That matters here because the settlement requires both.
What I would do first
First, I would go through your client list for health care providers and similar organizations that may be covered entities, then look at what you receive from them, such as payroll files, billing records or anything that pairs a patient's name with a financial detail. Second, I would check that an agreement addressing how you protect that information is signed and easy to find. Third, I would confirm you have a written, current risk analysis covering every place those records travel and rest, and a risk management plan with owners. Finally, I would test recovery, because software backups only help if you can restore from one kept off the network that would be encrypted. Ransomware is as much an operations problem as a security problem, and a firm that can answer recovery questions calmly is in a far better position than one that learns the answers during an attack.
If you want to know whether HIPAA touches your firm, a conversation on a call with AssureRidge Cyber is a good place to begin.