In this episode, Chase Cannon and Suzanne Spradley discuss a few HIPAA lessons that employers can glean from recent Health and Human Services (HHS) enforcement settlements. Chase begins with an outline of HIPAA’s obligations in the group health plan context and HHS enforcement trends. Chase and Suzanne discuss three different cases that resulted in monetary penalties, highlighting the importance of responding timely to participant requests for their personal information, running a risk assessment on internal systems, and protecting against and timely responding to cyberattacks and other breaches. The podcast winds down by highlighting the top five issues seen in HHS enforcement cases in recent years and includes a short discussion of NFP resources that can assist employers in complying with HIPAA.