The Department of Health and Human Services has announced the Center for Children's Digestive Health has paid the agency $31,000 to settle potential HIPAA violations and agreed to put in place a corrective action plan. The small, for-profit health care provider did not have a Business Associate Agreement in place with a vendor even though it was disclosing personal health information beginning in 2003. As of Oct. 2015, neither party could produce a signed BAA. The HHS press release also included the "Resolution Agreement" and the "Corrective Action Plan." 
Full Story