It is worth noting that, though this breach actually occurred during the time when CHCS owned the nursing homes, OCR chose to describe this as a settlement with a business associate—perhaps to underscore the importance of business associate compliance. Under BAA contractual obligations, business associates are specifically required to comply with the provisions of the HIPAA Security Rule and the corollary Breach Notification Rules. Thus, business associates of all types should take advance steps to ensure compliance so they will be prepared in the event of an OCR audit or investigation. The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.