In this week’s episode, Rebecca Schaefer and Hannah Maroney discuss a string of recent HIPAA enforcement actions which demonstrate that the HHS Office of Civil Rights (OCR), the agency tasked with enforcing HIPAA, is increasingly focused on ensuring that affiliated hospitals within a health system, typically comprising an Affiliated Covered Entity (ACE), have HIPAA business associate agreements in place with the parent corporation to allow for the lawful exchange of PHI. The presenters discuss the circumstances in which a business associate agreement may be required, and address several questions regarding related ACE organizational considerations.