Weiss & Co. adds Weitzman
Courtesy of Weiss & Co. Details: Weiss & Co. LLP, a firm based in Glenview, Illinois, has merged in the practice of Dan Weitzman, a CPA in Glenview who is joining the firm as a principal. "Dan is a gifted professional whose skill set is uniquely suited to our firm," said Weiss
managing partner Daniel A. Fortman in a statement earlier this month. "When he expressed interest in coming on board, we jumped at the chance." Financial terms of the deal were not disclosed. Weitzman has nearly four decades of experience in public accounting, operating as an independent practitioner for the past 14 years. He also provides advice to closely held businesses and individuals on various tax matters. He has taught accounting at Roosevelt University and the University of Illinois, and speaks about tax issues to companies and professional groups including Citibank, Chicago Tribune, the Chicago Bar Association, the Illinois CPA Foundation and the Pennsylvania CPA Society. BST & Co. merges in O’Connor & O’Connor
BST managing partner Ron Guzior
Mainframe Photography Inc. Details: BST & Co. CPAs LLP added O'Connor & O'Connor CPAs, an accounting firm in Albany, New York, that has served clients in New York State's Capital region and beyond for over 50 years. O'Connor & O'Connor CPAs offers accounting, financial and tax services to businesses and nonprofits. The team includes four CPAs and administrative staff and serves small businesses, professional service firms, professional athletes, medical practices, real estate agencies, and individuals among its clients. O'Connor & O'Connor CPAs was originally established as a part-time practice under the sole leadership of John V. O'Connor Sr., a full-time professor of accounting and taxation at UAlbany and Siena College. After earning his degree from St. Bonaventure University and getting licensed as a CPA, his son John V. O'Connor Jr. joined the firm in 1981. The father- and-son team formed O'Connor & O'Connor CPAs in 1984. O'Connor Jr.'s sister Mary, an alumnus of Bryant College and CPA, came onboard three years later. Prior to the merger with BST, the sibling team of CPAs managed the business. "BST is thrilled to join forces with O'Connor & O'Connor CPAs, whose culture, clients and reputation are second to none," said BST & Co. managing partner Ron Guzior in a statement. "John and I have known each other professionally and socially for 35 years and we are excited for our firms to come together at this time. We are confident that the many years of expertise the veteran tax specialists from O'Connor & O'Connor bring to our team will benefit our existing clients and enable us to cultivate deeper relationships through expanded solutions for O'Connor & O'Connor clients." BST & Co. dates back to 1947 and has more than 100 partners and associates. "We are excited to partner with a firm that shares similar client service focus, demonstrated professionalism, and a common culture," said John O'Connor Jr., in a statement. "BST's expansive resources, such as sophisticated Information Technology, Marketing and Virtual Accounting tools, will give us the edge we need to better compete in today's global marketplace and offer our staff greater opportunities for professional growth." The partnership with O'Connor & O'Connor marks the second merger for BST in less than two years. Last year, BST created a new wealth management division called Affinity BST Advisors after a merger between BST Wealth Management LLC and the Affinity Group, a wealth management firm. Later this month, BST plans to move its Albany-based corporate headquarters to 10 British American Boulevard to accommodate its expanded operations in a 25,000-square foot workspace. The team from O'Connor & O'Connor will join BST at the new location in mid-December.

M&A roundup: Weiss and BST expand

Class Action Alleges Firm Was 'Negligent' In Protecting Medical Group's Information Marianne Kolbasuk McGee ( HealthInfoSec )                                                    • June 11, 2020    
Get Permission
The class action filed by a patient against BST alleges the accounting firm failed to protect Community Care Physicians' data. This article has been updated. A proposed class action lawsuit filed against an accounting firm in the wake of a 2019 ransomware incident that allegedly exposed patient information serves as the latest reminder of the security and privacy risks posed by vendors. In the lawsuit filed on May 27 in the New York state supreme court, lead plaintiff Elmer Keach - a patient of Community Care Physicians , a large multispecialty medical group in update New York - alleges, among other claims, that accounting firm BST & Co. CPAs LLC was "negligent and reckless" in protecting CCP's patient information from "unauthorized intrusions." The class action complaint also alleges that some of the data that was breached as a result of the December 2019 ransomware attack on Albany, N.Y.-based BST has potentially shown up on the publicly accessible website of ransomware gang Maze . "Despite learning of the ransomware attack on Dec. 7, 2019, notification letters were not sent to affected patients until more than two months later on or around Feb. 14, 2020 - well after the Maze ransomware gang published the private data online for all cyberthieves to access," the lawsuit alleges. CCP is not named as a defendant or plaintiff in the lawsuit. CCP did not immediately respond to an Information Security Media Group request for comment. BST declined ISMG's request for additional details about the lawsuit and data security incident, saying it does not comment on pending litigation. Keach is being represented by New York-based law firm Chaffin Luhana, which did not immediately respond to ISMG's request for comment on the lawsuit. Breach Details
The lawsuit complaint alleges that the information of 170,000 individuals was impacted in the ransomware incident involving BST's network. While BST reported the "hacking/IT incident" on Feb. 16 to the Department of Health and Human Services as affecting 170,000 individuals, based on an entry on the HIPAA Breach Reporting Tool website -  that report does not reflect whether all the individuals affected are CCP patients. The HHS Office for Civil Rights' breach reporting website lists health data breaches affecting 500 or more individuals. In a breach notification statement issued in February, BST said the "virus" incident that prevented access to files on its network potentially impacted "data for some of BST's local clients to whom the company provides accounting and tax services," including CCP. BST's says in the statement that its investigation determined that "certain personal or protected health information for individuals may have been accessed or acquired without authorization, including individuals' names, dates of birth, medical record numbers, medical billing codes, and insurance descriptions." However, patient medical records and Social Security numbers were not impacted by this incident, BST said in its statement. Still, BST added that it cannot confirm that any individual's personal information was actually accessed or viewed without permission. Multiple 'Failures'
The lawsuit against BST alleges that the accounting firm "intentionally, willfully, recklessly, or negligently failed to take adequate and reasonable measures to ensure its data systems were protected against unauthorized intrusions." Additionally, the suit alleges that BST failed to disclose that it did not have "adequately robust computer systems and security practices" to safeguard patients' private information; failed to take standard and reasonably available steps to prevent the ransomware attack; and failed to provide "prompt and accurate notice" of the attack. "Any professional services company that receives, stores, or processes PHI must be aware that it is handling sensitive information." —Steven Teppler, Mandelbaum Salsburg P.C. "Defendant BST and its employees failed to properly monitor the computer network and systems that housed the private information," the lawsuit alleges. "Had BST properly monitored its property, it would have discovered the intrusion sooner," the lawsuit alleges. Patients' identities "are now at risk because of [BST's] negligent conduct since the private information that CCP collected and maintained through its agent, BST, is now in the hands of data thieves," the complaint contends. The plaintiff and class members in their lawsuit against BST are seeking compensatory damages, reimbursement of out-of-pocket costs, improvements to the firm's data security systems, future annual audits, and "adequate credit monitoring services" funded by BST. Besides negligence, the suit also alleges BST breached of fiduciary duty to protect private information and violated New York state laws pertaining to deceptive business practices. Vendor Lawsuits
The lawsuit against BST is certainly not the first involving patient data breaches at firms handling financial related and other business activities for healthcare sector entities. For instance, more than a dozen class action lawsuits were filed last year by individuals alleging they have been injured by a 2018 cyberattack on American Medical Collection Agency , which impacted the data of more than 20 million patients of at least 20 medical laboratory testing and other healthcare sector organizations. Lessons to Learn
Breaches like the ones involving BST, AMCA, and similar vendor security incidents spotlight critical issues for healthcare sector clients and those third-parties, experts say. "Any professional services company that receives, stores, or processes PHI must be aware that it is handling sensitive information," says technology attorney Steven Teppler of the law firm Mandelbaum Salsburg P.C., which is not involved in the case. "In [the BST] case, taking the allegations at face value, the CPA firm should have been aware [of the risks] because of the nature or the services provided to the healthcare provider, who entrusted at least a portion of its patient's PHI to BST, and taken security measures commensurately appropriate with its status as a business associate" under HIPAA , Teppler says. Meanwhile, healthcare organizations should take steps to assess the type and amount of data that is being shared in every vendor relationship, says privacy attorney David Holtzman of the cybersecurity, compliance and privacy consultancy CynergisTek. "Ensure that your organization can justify the necessity for protected health information to be provided to your vendor along with ensuring that it is kept to the minimum necessary for the contractor to perform the function they have been hired to perform," he says. "Put measures in place to ensure that tracks what data is being created or maintained by your vendor. Make sure there your business partner has a data retention program that aligns with your own and returns or securely disposes of personal information once it is no longer needed or required to be kept." Uphill Battle? As for the lawsuit against BST contending that patients are at risk in part due to the Maze ransomware gang alleging posting on its dark web site information stolen in the attack -  that could potentially help strengthen plaintiff arguments, Teppler says. "In my opinion ... it shows that the information is and has been actively marketed, and either has been sold or could be sold at any moment," he says. "Healthcare information ... presents an elevated potential for harm owing to the uniqueness and permanence of the information. A threat actor could compromise/steal a victim's identity immediately, or 'age' it for a period of time to lull the victim into complacence," he says. "The threat, however, remains imminent." But attorney Holtzman, who is not involved in the BST case, says the complaint filed in a New York court against the accounting firm "would seem to have a very steep hill to climb to be successful." For example, the NY SHIELD Act's expanded breach notification requirements that took effect in October 2019 "would require a contractor or vendor that did not own the data to provide notification to the data owner, in a similar manner to how a HIPAA business associate would notify the covered entity of an incident that compromised the confidentiality of PHI," he says. Also, "NY laws that require breach notification as well as recent new provisions in the SHIELD Act that set tough standards to safeguard personal information from unauthorized access and disclosure expressly do not provide a consumer a private right of action to seek damages in the event of a breach."

Lawsuit Filed Against Accounting Firm in Patient Data Hack

Four things to know:
1. The Community Care Physicians patient filed a proposed class-action complaint in May against BST & Co., which suffered a ransomware attack on Dec. 7 that exposed data from Community Care Physicians as one of the firm's clients. 2. Some of the files accessed in the attack included patient names, birth dates, medical record numbers, medical billing codes and insurance descriptions. BST notified affected patients in February. 3. The lawsuit alleges the firm failed to implement adequate cybersecurity procedures and should have notified patients of the attack and information exposure in December. It also claims that BST did not provide enough protection for individuals whose data was stolen. 4. The lawsuit does not name Community Care Physicians. More articles on cybersecurity:

Patients sue New York physician group's accounting firm over ransomware incident

Photographer: Erica Miller
COLONIE — A data breach at an accounting firm has potentially exposed the personal data of patients at the largest independent medical practice in the Capital Region. Some of the 370,000 patients of Community Care Physicians got letters Tuesday from BST & Co. CPAs about the matter. Community Care followed up Wednesday with notices to patients about the situation and how best to respond. Neither BST or Community Care would say how many people are potentially affected. Community Care said it was not all 370,000 patients, but was more than the 500-person threshold for mandated reporting under federal healthcare privacy rules. BST also would not say if any of its other clients were affected, but it noted that data for some of the other clients was stored on the computer network that was breached. The situation stems from a December ransomware attack on BST. Community Care patient data was exposed but there is no evidence it was accessed or misused, BST said. Also, it said, the data involved was not the most sensitive type, such as bank account numbers, social security numbers or medical records — it was patient names, birthdates, record numbers and billing codes. Nonetheless, BST is outlining steps patients can take to protect themselves financially, and is offering free identity monitoring for a year. Community Care is based on Route 7 in Latham and is a significant part of the Capital Region medical community. It has 400-plus practitioners in 30 specialties plus 1,600 other employees spread across 80 locations in eight counties. BST is a large accounting and financial management firm based off Wolf Road in Colonie. In a prepared statement Wednesday, Community Care Corporate Compliance Officer Mackensie Greene said there have been no known adverse effects on patients in the 10 weeks since the breach. “We have a longstanding relationship with BST and we have been working very closely with them to monitor this unfortunate and isolated event. We feel very confident that our patients’ data is secure with either company. This incident was quickly identified and addressed and we know that BST is doing everything in their power to assist our patients who were affected.”
In a prepared statement of its own, BST said it is taking steps to notify and protect people “out of an abundance of caution.”
“Unfortunately, data security incidents have become increasingly common and are impacting organizations both large and small, public and private,” BST said. “We are committed to ensuring the security of all data under our care, and encourage all to remain vigilant about the growing occurrence of cyber threats.”
In separate notifications, BST and Community Care outlined the incident as follows:
-- BST determined on Dec. 7 that hackers outside the company had infected part of its network containing client accounting and tax data with a ransomware virus three days earlier. -- BST was able to restore files using backup. -- A subsequent forensic examination confirmed on Feb. 5 that some patients’ personal information had been exposed. -- Using addresses on file for those patients, BST mailed out notifications to them Feb. 14. There was no mail delivery on Monday, a federal holiday, so the letters began to arrive at patients’ homes Tuesday. -- BST has created an assistance line at 866-977-0784 ; patients can call for additional help from 9 a.m. to 9 p.m. weekdays. -- Any Community Care patients who did not receive a letter but want to verify their data was not breached can call the hotline as well. BST offered advice:
-- Anyone noticing unusual account or credit report activity should contact a local law enforcement agency. -- Check credit reports regularly. Under federal law, adults are entitled to one free credit report per year from each of the three major credit bureaus — Equifax, Experian and TransUnion — and can contact them directly or visit  www.annualcreditreport.com . -- Individuals can activate a free fraud alert with the credit bureaus, which better protects the individual from fraud but will also slow down their legitimate efforts to obtain credit. -- Individuals can also place a security freeze on their credit reports; while this offers even more protection, it is tedious to activate and remove, and can greatly slow or even block legitimate credit checks for everything from apartment leases to job applications to car loans. -- Further information on protecting against identity theft and fraud is available from the Federal Trade Commission at  www.ftc.gov/idtheft/  and from the New York state Attorney General’s Office at  https://ag.ny.gov/consumer-

Community Care Physicians Notifies Hundreds of Thousands of Patients of Potential Third-party Breach Involving Medical Records

Mackenzie Garrity -
Latham, N.Y.-based Community Care Physician began notifying an undisclosed number of patients Feb. 14 that their information may have been affected in a ransomware attack at third-party accounting vendor BST & Co. The Albany, N.Y.-based accounting firm discovered that its computers had been infected with ransomware in December 2019. BST worked quickly to restore its systems, with the ransomware only being present between Dec. 4-7, 2019. Though there is no evidence that patient information was removed from its system, BST and Community Care Physicians are alerting patients of the incident. Information that may have been affected by the ransomware attack included names, dates of birth, billing codes, insurance descriptions and medical record numbers. "[Community Care Physicians] takes our patients' security and privacy very seriously. It's important to know this was not a Community Care Physicians incident," the health system said in an online statement. "Our patients' data remains secure with [Community Care Physicians]. BST immediately addressed the incident and it was successfully handled. The data involved wasn't the most sensitive type of data. It didn't include EMR data, financial information or social security numbers, or even addresses … We also have no evidence that any of this data was accessed or used by anybody." More articles on cybersecurity:

New York health system alerts patients of ransomware attack at third-party vendor

Merger

Spinoff / Spinout

BST & Co., formerly Bollam Sheedy Torani & Co., is a multi-disciplinary accountancy and financial management consulting firm.

Wells Fargo Success Story

Professional Services

Platform Overview

BST & Co.

Compete with BST & Co.?

Compete with BST & Co.?

Discover the right solution for your team