Two recent HIPAA breaches in Florida should be a warning for every medical office and healthcare provider: your practice can be held responsible for the mistakes of your vendors. Under HIPAA, outside vendors that handle or access patient data are considered Business Associates, and if they fail to protect that data, your practice could face investigations, fines, and public breach notifications.
What Happened in These Two Florida Breaches:
PhyNet Dermatology & Premier Dermatology Partners
In November 2024, PhyNet Dermatology—an outside IT business associate for Premier Dermatology Partners—detected suspicious activity in employee email accounts. Hackers potentially accessed:
- Names, addresses, and Social Security numbers
- Medical histories, treatment details, and physician names
- Health insurance information
In June, investigators confirmed the scale of the breach. PhyNet responded with new staff training and safeguards that should have already been in place.
Baptist Health South Florida & Oracle Health (Cerner)
In January 2025, a cyberattack targeted Oracle Health’s legacy Cerner servers, impacting Baptist Health South Florida. While Baptist’s own systems weren’t breached, patient data on the vendor’s servers—including diagnoses, images, and lab results—were exposed.
Law enforcement requested a delay in breach notifications, but the organization is now offering patients identity protection services.
Why This Matters to Your Practice
If you’re a physician, clinic, or healthcare administrator, here’s the hard truth:
- HIPAA Holds You Responsible – Even if the breach happens at your vendor, your practice is a covered entity and can face liability if you didn’t do due diligence.
- Patients Will Blame You First – To the public, the breach happened at your practice, not your IT provider.
- Fines and Lawsuits Are Real – OCR investigations can lead to hefty fines, and patients may seek damages.
- Trust Is Hard to Rebuild – A single breach can undo years of goodwill with your patients.
How to Protect Your Practice from a Vendor Breach
- Demand a Signed Business Associate Agreement (BAA) – This is not optional. It must clearly outline HIPAA compliance responsibilities.
- Ask for Proof of HIPAA Training – Ensure your IT provider trains employees annually on HIPAA and security best practices.
- Require Annual HIPAA Risk Assessments – Don’t just take their word—review the reports.
- Confirm Technical Safeguards – Ask how they encrypt data, monitor for intrusions, and secure email.
- Review Compliance Regularly – Vendor oversight is an ongoing process, not a one-time checkbox.
Choosing the wrong IT provider can cost your practice more than money—it can cost your reputation. HIPAA compliance isn’t just for your staff—it’s for everyone who touches your patient data. Our HIPAA Compliance checklist is here if you need it.
At A Better Choice Network Solutions, we specialize in HIPAA-compliant IT support for healthcare providers across Florida. We provide documented compliance measures, thorough risk assessments, and proactive security to protect your patients and your practice.
Please Note: A Better Choice Network Solutions offers advice on best practices regarding cybersecurity and compliance assessments, not legal advice.