Billing partners hold credentials to patient systems. That is your HIPAA liability.

When Florida-based medical billing company Professional Finance Company suffered a ransomware attack in February 2023, the breach exposed protected health information for over 1.9 million patients across multiple healthcare providers. The incident highlighted a critical vulnerability in healthcare's extended digital ecosystem: third-party billing partners routinely hold administrative credentials to patient systems, creating compliance liabilities that healthcare organisations struggle to monitor or control.

The credential control problem in healthcare supply chains

Healthcare organisations operate within complex webs of billing companies, insurance processors, pharmaceutical suppliers, and technology vendors. Each partner requires varying levels of system access to perform contracted services. Medical billing firms need access to patient records and financial systems. Pharmacy benefit managers require integration with prescription databases. Electronic health record vendors maintain administrative privileges across clinical systems.

The fundamental issue lies in how these access privileges are managed. Most healthcare organisations issue credentials directly to partner employees, who then create, store, and manage passwords according to their own security protocols. This distributed credential management creates blind spots in access control and potential violations of HIPAA's administrative safeguards requirements, which mandate that covered entities implement procedures for granting access to electronic protected health information.

Under HIPAA's Security Rule, healthcare organisations remain liable for breaches involving their data, even when the incident occurs at a business associate. The regulation requires covered entities to ensure that business associates implement appropriate safeguards, but traditional credential sharing makes this oversight nearly impossible.

Scale of third-party access in healthcare

Healthcare supply chain security incidents increased by 42% between 2022 and 2023, according to the Cybersecurity and Infrastructure Security Agency's healthcare threat landscape report. The Department of Health and Human Services breach database shows that third-party incidents accounted for 64% of major healthcare data breaches in 2023, affecting over 75 million patient records.

A survey by the Healthcare Information and Management Systems Society found that the average healthcare organisation grants system access to 47 external vendors. Large hospital systems work with over 200 third-party technology providers. Each vendor relationship typically involves multiple user accounts across different systems, creating thousands of credential touchpoints that require ongoing management.

The financial implications are substantial. The average cost of a healthcare data breach reached $10.93 million in 2023, according to IBM's Cost of a Data Breach report. When third parties are involved, resolution costs increase by an average of $370,000 due to the complexity of incident response across multiple organisations.

Regulatory enforcement is intensifying. The Office for Civil Rights issued $42.4 million in HIPAA violation penalties in 2023, with inadequate access controls cited as a contributing factor in 73% of cases involving business associates.

Why existing security tools fall short

Healthcare organisations typically deploy identity and access management systems, privileged access management platforms, single sign-on solutions, and multi-factor authentication to secure partner access. These tools address authentication and authorisation but fail to solve the fundamental credential control problem.

Identity and access management systems excel at provisioning and deprovisioning user accounts but rely on users to create and manage their own passwords. When a billing company employee leaves their organisation, the healthcare provider may revoke system access, but cannot guarantee that stored credentials are not retained or misused.

Privileged access management platforms provide session monitoring and password vaulting for internal administrators but struggle with external partner access patterns. Billing companies and other vendors require persistent access across multiple systems over extended periods, making session-based controls impractical.

Single sign-on solutions reduce password proliferation but concentrate risk in federation protocols and identity provider compromise. Multi-factor authentication adds security layers but cannot prevent credential theft through sophisticated phishing campaigns targeting partner employees.

Zero trust architectures attempt to address these limitations through continuous verification and least-privilege access models. However, they still depend on traditional credential structures where users possess authentication factors that can be compromised or misused.

A structural approach to credential control

The solution requires rethinking the relationship between identity and access control. Instead of allowing partner organisations to create and manage credentials for accessing healthcare systems, the healthcare organisation can maintain complete control over all authentication factors while enabling seamless access for authorised users.

This approach involves the healthcare organisation generating and distributing encrypted credentials to partner employees without those users ever seeing or storing the actual authentication information. When a billing company employee needs to access patient systems, their local software communicates with the healthcare organisation's credential control system to obtain temporary access tokens.

MyCena's patented credential control platform implements this model by separating user identity from access credentials. Healthcare organisations generate all passwords and authentication factors, encrypt them with keys that never leave their control, and distribute encrypted packages to partner employees. Users can access required systems without possessing credentials that could be phished, stolen, or retained after employment termination.

This architecture makes access unphishable because users never see credentials that attackers could steal through social engineering or malicious websites. It also provides healthcare organisations with complete visibility and control over partner access, supporting HIPAA compliance requirements for business associate oversight.

Implications for healthcare compliance strategy

Healthcare organisations must recognise that traditional approaches to partner access management create inherent HIPAA liability. Issuing credentials directly to business associates removes organisational control over a critical security component and makes breach prevention dependent on third-party security practices.

The regulatory environment demands a more proactive approach. Healthcare leaders should evaluate their current business associate agreements to identify credential control gaps and assess whether existing technical safeguards provide adequate oversight of partner access.

Implementing organisation-controlled credential management represents both a security upgrade and a compliance investment. By maintaining control over all access credentials while enabling necessary business partner functionality, healthcare organisations can reduce breach risk while demonstrating stronger adherence to HIPAA's administrative safeguards requirements.

The cost of prevention remains substantially lower than the cost of breach response, particularly when third-party relationships complicate incident management and regulatory reporting obligations.

Agent fraud in BPOs: the credential problem nobody talks about

When Teleperformance disclosed in March 2023 that fraudulent agents had gained unauthorised access to customer data across multiple client programmes, the breach exposed a vulnerability that most Business Process Outsourcing executives prefer not to discuss: their own employees systematically exploiting credential weaknesses to commit fraud.

The incident, which affected operations across several countries and compromised sensitive customer information including financial data, was not the result of external hackers or sophisticated cyber attacks. Instead, legitimate agents with authorised system access had weaponised their credentials to access data beyond their designated scope, then monetised this information through identity theft and financial fraud schemes.

The insider credential crisis in BPO operations

Business Process Outsourcing organisations face a unique security paradox. They must grant thousands of remote agents access to their clients' most sensitive systems—banking applications, healthcare records, insurance claims, customer service platforms—whilst maintaining virtually zero tolerance for data breaches. Yet the industry's credential management practices remain rooted in consumer-grade password systems that assume users will act responsibly with their access privileges.

This assumption proves catastrophic when applied to BPO operations. Unlike traditional corporate environments where employees have long-term relationships with employers, BPO centres experience annual turnover rates exceeding 50%. Agents frequently work across multiple programmes, accumulating access to diverse client systems. When these agents control their own credentials—creating passwords, managing authentication factors, and retaining access details—the organisation effectively loses control over its most critical security perimeter.

The problem extends beyond individual bad actors. Organised fraud networks actively recruit BPO agents, offering substantial payments for credentials or system access. In markets where average agent salaries range from $3,000 to $8,000 annually, fraudsters can offer compelling incentives for credential sharing or abuse.

The scale of internal fraud in managed services

Industry data reveals the magnitude of insider threats in BPO operations. According to Verizon's 2024 Data Breach Investigations Report, internal actors were responsible for 20% of all data breaches across business services sectors, with financial motivation driving 83% of these incidents.

The Association of Certified Fraud Examiners' 2024 Report to the Nations found that organisations with significant outsourced operations experienced median fraud losses of $200,000 per incident, compared to $120,000 for companies with predominantly internal operations. The report attributed this disparity to reduced oversight and control over credential management in outsourced environments.

Specific to BPO operations, Ernst & Young's Global Fraud Survey 2024 identified credential abuse as the primary vector for internal fraud, affecting 67% of surveyed organisations within the business services sector. The survey noted that traditional detection methods typically identify such breaches 14 months after initial compromise, by which time fraudulent agents have often extracted substantial customer data.

Financial services clients bear particular risk. The Federal Trade Commission reported a 70% increase in identity theft cases linked to customer service data breaches between 2022 and 2024, with investigation patterns suggesting significant BPO involvement in data extraction activities.

Why traditional security tools miss the mark

Most BPO organisations deploy sophisticated security architectures—Identity Access Management systems, Privileged Access Management tools, Single Sign-On platforms, Multi-Factor Authentication, and Zero Trust frameworks. Yet these solutions fundamentally assume that credential holders will use their access legitimately.

Multi-Factor Authentication exemplifies this weakness. When agents control both password creation and authentication factors—typically their personal mobile devices—MFA provides no protection against deliberate credential misuse. Fraudulent agents simply use their legitimate credentials and personal devices to access systems outside their authorised scope.

Privileged Access Management systems face similar limitations. They excel at controlling administrative access but struggle with the granular session monitoring required across thousands of simultaneous agent interactions. When agents legitimately access customer records as part of their duties, PAM tools cannot distinguish between authorised data handling and systematic data extraction for fraudulent purposes.

Zero Trust architectures, despite their sophisticated verification mechanisms, typically verify identity rather than controlling access directly. Once agents authenticate—using credentials they control—the framework trusts their subsequent actions within authorised systems.

These tools share a common vulnerability: they authenticate identity but cannot prevent authenticated users from exploiting their legitimate access for illegitimate purposes.

The structural solution: organisational credential control

The Teleperformance breach and similar incidents highlight a fundamental principle: organisations cannot control access they do not own. When employees create, manage, and retain their own credentials, the organisation's security perimeter effectively extends to every individual's personal security practices and ethical decisions.

Advanced credential control systems reverse this model entirely. Rather than users creating passwords and managing authentication factors, the organisation generates, encrypts, and distributes every credential. Agents never see their passwords or hold authentication tokens. Access becomes a service provided by the organisation rather than a privilege exercised by individuals.

Under this model, system authentication occurs through encrypted credential injection directly from organisational servers. Agents cannot share credentials they have never seen, cannot reuse passwords they do not know, and cannot retain access details after employment termination. The organisation maintains cryptographic control over every authentication event.

This approach transforms phishing from a credential harvesting exercise into a pointless activity—stolen credentials exist only as encrypted data useless to attackers. Similarly, insider fraud becomes significantly more complex when agents cannot directly manipulate their authentication mechanisms.

Implementation imperatives for BPO executives

The credential control model requires fundamental changes to BPO security architectures, but the implementation path is straightforward. Organisations must shift from identity verification to access provision, treating credentials as organisational assets rather than user conveniences.

This transition becomes particularly urgent as regulatory frameworks evolve. The EU's proposed AI Liability Directive will likely increase BPO liability for client data breaches, whilst updated PCI DSS requirements already mandate enhanced authentication controls for payment processing environments.

BPO executives should evaluate their current credential management practices against a simple test: if an agent attempted to misuse their access for fraudulent purposes, could the organisation detect and prevent such activity in real-time? If the answer involves monitoring user behaviour rather than controlling access mechanisms, the organisation likely remains vulnerable to the next Teleperformance-style incident.

The industry's credential problem is solvable, but only through acknowledging that identity verification cannot substitute for access control.

BPO & Contact Centre