Open Enrollment Season Is Also Phishing Season
Open enrollment creates new opportunities for benefits-related phishing scams.
← Blog
Security
Guidance on security administration and compliance — practical resources for employers, brokers, and benefits teams navigating real operational questions.
119
Security Articles
Available in the BAS resource library
119 Articles
The Security Risk of Downloading Employee Data to Your Computer
Downloading a report may take only a few seconds, but the file can remain on a computer for months or even years.
A Security Checklist for HR Before Open Enrollment Starts
A security review before enrollment begins can help eliminate unnecessary risks.
Securely Handling Employee Data Throughout Its Lifecycle
Security should be considered throughout information's entire lifecycle, from collection through disposal.
Check Who Needs the File Before Sharing
Before sharing information, ask a simple question: What does this person actually need to perform the task?
Personal Email and Work Data Don't Mix
Sending a work document to a personal email account can move sensitive information outside of an employer’s security protections.
The Security Risk of Sending Sensitive Information to the Wrong Email Address
Technology makes it easy to share information quickly, but that convenience may also create security risks.
Common Business Email Compromise Scams Targeting HR and Payroll
Business Email Compromise (BEC) scams continue to be one of the most costly cyber threats facing employers.
Clean Desk Practices Matter in HR
Protecting sensitive information also requires attention to physical security.
Why Multi-Factor Authentication Alone Isn't Enough
MFA is no longer a guarantee that an account cannot be compromised.
Why HR Should Be Suspicious of Last-Minute Banking Changes
HR and payroll departments are frequent targets of business email compromise scams.
Why HR Should Regularly Review Distribution Lists
Email distribution lists make communication easy, but outdated lists can create unnecessary security and privacy risks for HR and benefits departments.
A Written Information Security Plan As An Important Tool for HR and Benefits Administration
The IRS recently highlighted the importance of maintaining a Written Information Security Plan to protect sensitive HR and benefits data from cyber threats.
Why HR Should Regularly Review User Access to Benefits Systems
HR and benefits departments should regularly review who has access to enrollment, payroll, and carrier systems to reduce security risks before problems arise.
HHS Signals Continued Focus on Health Plan Privacy and Cybersecurity
Privacy and security are enforcement priorities for government regulators following HHS's restructuring of its Office for Civil Rights.
Risk Assessments Are Only the Beginning: The Importance of Following Through
Federal regulators continue to emphasize that an effective security program requires more than documenting vulnerabilities.
Risk Assessments Are Only the Beginning: The Importance of Following Through
Identifying security vulnerabilities is only the first step — organizations must implement remediation plans and maintain documentation that safeguards are actively in place.
HHS Releases Updated HIPAA Security Rule Guidance Materials
HHS confirms that HIPAA compliance is not a one-time exercise, but an ongoing process that requires organizations to continuously assess, manage, and reduce security risks.
The Most Common HR Email Mistakes That Lead to Data Exposure
Email is one of the most common ways sensitive employee information is unintentionally exposed.
How Attackers Use Fake Benefit Notices and COBRA Scams
Cybercriminals continue to target employees and former employees using fake benefits communications designed to steal personal information.
Why Prompt Reporting of Security Concerns Matters
In HR and benefits administration, employees and administrators handle sensitive information every day.
Strengthening Account Security with Multi-Factor Authentication
Protecting employee and benefits data requires more than a strong password — MyEnroll360 incorporates Multi-Factor Authentication as a core layer of platform security.
Phishing Isn’t Just Email Anymore
Cybercriminal phishing attempts are getting more sophisticated, now reaching HR teams via text messages, voicemails, QR codes, and fake benefit notices.
Phishing Risks Tied to W-2 and Tax Season Requests
Tax season increases phishing attempts targeting W-2 and payroll data making awareness and verification especially important for HR teams.
Avoiding Accidental Data Exposure When Sharing Files Internally
Sharing files internally is routine, but small missteps can expose sensitive information.
Reporting Suspicious Emails or Security Incidents: Guidance for HR Teams
HR plays an important role in setting expectations, reinforcing reporting procedures, and creating a culture where employees feel comfortable raising concerns quickly.
Phishing Trends HR Should Expect in 2026
As HR professionals continue to rely on digital tools for payroll, benefits, onboarding and employee communication, cybercriminals are adapting their tactics just as quickly.
A Key Step in Protecting Your MyEnroll360 Data
Timely access termination is one of the strongest safeguards against unauthorized activity and data breaches.
MyEnroll360 Enhanced Password Security & Modernized User Settings
MyEnroll360 introduces enhanced password-security tools and a refreshed, modernized user-settings interface, supporting stronger account protection and a seamless user experience.
Talking to Employees About Benefits-Related Phishing Scams
Phishing scams have become increasingly sophisticated, and benefits-related fraud is on the rise.
Securely Managing Remote HR Teams
As remote and hybrid work models continue to shape the modern workplace, HR professionals face unique challenges in protecting sensitive employee data outside of traditional...
Phishing Scams Targeting Benefits Administrators
HR and benefits professionals are increasingly becoming prime targets of phishing scams.
Security Spotlight: Lessons from the 2025 IRS Summer Security Summit
The IRS and its Security Summit partners recently concluded their annual five-week campaign, Protect Your Clients; Protect Yourself .
Security Tips for HR Teams Distributing Benefits Information
If not handled properly, benefits information can expose both employees and the company to data breaches and compliance issues.
HHS Releases Updated HIPAA Security Risk Assessment Tool (Version 3.6)
There is an updated version of the HHS Security Risk Assessment Tool which helps organizations evaluate and manage risks to PHI.
ACA Compliance Alert: Don't Overlook Dependent Social Security Number Requirements
Employers must collect Social Security Numbers for everyone with health coverage.
Protecting Employee Data from Evolving Email Threats
There is a growing threat of phishing scams designed to steal sensitive information.
How Cybercriminals Exploit HR to Launch Attacks
HR departments handle sensitive information that makes them a natural target for cybercriminals.
Why Ransomware Attackers Are Targeting Your HR Department
HR departments across the country are finding themselves in cybercriminals' crosshairs, and the reason is simple: you hold the keys to your organization's most valuable...
The Importance of Employees Setting Up Multi-Factor Authentication (MFA) for System Access
One of the simplest and most effective ways employees can help safeguard company systems and personal information is by enabling multi-factor authentication.
Why Employers Should Maintain a Written Information Security Plan (WISP)
Whether you are a tax firm or an employer collecting personal data through benefits enrollment or payroll, a WISP should be part of your compliance and risk management toolkit.
Protecting Employee Benefit Data
Protecting employee benefit data requires a combination of strong systems, clear policies, and ongoing training.
Security Concerns in the Workplace
As the workplace continues to evolve, so do the security risks facing organizations of all sizes.
Managing BYOD Risks in the Workplace
Employees accessing company systems from personal devices raises data security, privacy and compliance risks.
ACA Compliance Reminder: Collecting Dependent Social Security Numbers
Employers must collect Social Security Numbers for both employees and covered dependents.
What HR Needs to Know About Internal Threats
Internal threats, whether intentional or accidental, pose a significant risk to the security of sensitive HR information.
Helping Employees Make Smart Choices About Website Cookies
HR can encourage employees to make good choices about website cookie selections because not every cookie is a treat.
Password Security: A Small Step That Protects a Lot
In today’s digital workplace, strong password practices are more than an IT issue; they're a shared responsibility that protects employee data, business operations, and...
How to Help Employees Who Have Been Hacked
Employees should have clear, accessible guidance for recognizing and responding to cyber attacks.
Reporting Security Incidents: When and How to Speak Up
Creating an environment in which employees feel empowered to report potential security issues can prevent minor concerns from escalating into major events.
Preventing Insider Threats: Building Security Without Sacrificing Trust
Some of the most significant security vulnerabilities come from within the organization.
Avoiding Insider Threats: Identifying and Mitigating Risks from Employees with Access to Sensitive Data
While many businesses focus on external cyber threats, insider threats—risks that come from employees, contractors, or other trusted individuals—can be just as damaging.
Recognizing Social Engineering Scams: Protecting Yourself and Company Data
Employer awareness and caution are the best defenses against social engineering scams.
Tips for Avoiding Phishing Emails
Consider educating your workforce about phishing and how to avoid falling victim to scams.
Security Tip: Protect Your Business with Multi-Factor Authentication (MFA)
As cyber threats continue to evolve, ensuring your business’s digital security is more important than ever.
Government Plan for AI
The U.S. Department of Health and Human Services released a Strategic Plan for the use of AI in health, human services, and public health.
Security Insights from National Tax Security Awareness Week
The IRS and its Security Summit partners recently concluded the ninth annual National Tax Security Awareness Week, an initiative designed to help individuals, businesses, and...
Kickstarting the New Year: HR Tasks for January
The start of a new calendar year presents an opportunity for HR departments to reset, refocus, and ensure compliance with key deadlines.
Proposed Updates to the HIPAA Security Rule
Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced proposed changes to the HIPAA Security Rule, marking the first update since 2013.
Strengthen Your Organization’s Cybersecurity by Combating Social Engineering Attacks
Understanding social engineering threats is important for keeping company data safe.
Tips for Employers to Protect Data
During the ninth annual National Tax Security Awareness Week, the IRS and its Security Summit partners identified important steps to reduce the risk of tax scams and identity...
Interactive Security Risk Assessment
First introduced in 2014 and recently updated in 2023, the SRA Tool is a free, downloadable desktop application designed to assist organizations in conducting comprehensive...
Cybersecurity Skills Practice with the SANS Holiday Hack Challenge
An online holiday-themed security game provides free, hands-on cybersecurity practice.
Cybersecurity Alert: Rising Social Engineering Threats to IT Help Desks
Organizations are increasingly facing cybersecurity threats where attackers use social engineering tactics to bypass security controls.
New York State Issues Guidance on AI-Related Cybersecurity Risks
The State of New York has issued new guidance addressing the impact of artificial intelligence (AI) on cybersecurity, aimed at entities regulated by the Department of...
Working From Home? Stay Cyber-Secure
Maintaining company cybersecurity practices is just as important outside the office as it is in the office.
HIPAA Compliance and Health Plan Security: Key Updates from HHS
Health plans and employers should review their HIPAA compliance procedures regularly.
Protecting Employee Privacy in the Age of Remote Work
As remote work continues, ensuring employee privacy remains a significant concern.
Password Managers for Security
Requiring employees to use a password manager is a simple yet powerful step toward safeguarding company data and improving security.
Security Update: HR's Role in Preventing Phishing Attacks
HR professionals play a key role in maintaining workplace cybersecurity by educating employees about the risks of phishing and the importance of staying vigilant when it comes to
Cybersecurity Compliance and Health Plans
The government released confirmation that its cybersecurity guidance applies to health plans.
CISA’s Recommendations for HR Professionals
CISA has a list of free cybersecurity services and tools available from government and industry partners.
The Importance of Facility Access Controls in Security Compliance
As cyber threats increase, ensuring physical security measures are in place is just as important as protecting against digital breaches.
BAS Ongoing Privacy and Security Training
Benefit Allocation Systems prioritizes data security through its annual privacy and security refresher training for employees.
Phishing Emails
In today's digital age, phishing emails have become a pervasive threat to organizations worldwide, putting sensitive data and company security at risk.
Understanding the ACA Requirement for Reporting Social Security Numbers on IRS Form 1095-B/C
with Our Affordable and Accurate Solution One of the key administrative aspects of the Affordable Care Act (ACA) that HR professionals must navigate is the requirement to...
HHS Settles HIPAA Security Violations with Healthcare Provider Following Ransomware Attack
The Department of Health and Human Services (HHS) reached a settlement over potential HIPAA Security Rule violations following a ransomware attack on a healthcare provider...
Conducting a HIPAA Risk Assessment: Essential Steps for HR Professionals
Safeguarding health information is not just a best practice—it is a requirement under the Health Insurance Portability and Accountability Act (HIPAA).
Importance of Multi-Factor Authentication for Workplace Security
In today’s digital-first environment, safeguarding sensitive company and personal information is top of mind.
Essential Security Steps for HR Teams to Protect Employee Information
In today’s digital age, Human Resources (HR) departments hold an important responsibility in safeguarding employee information.
HHS Updates HIPAA Breach FAQs
Department of Health and Human Services’ Office for Civil Rights (OCR) recently updated its FAQs on their webpage regarding the cybersecurity incident at Change Healthcare, a...
Updating Compliance: The FTC Enhances Health Breach Notification Rules for Non-HIPAA Entities
The HIPAA Breach Notification Rule requirements have been updated and now require certain entities to notify individuals, the FTC, and sometimes the media about breaches of
Creating and Maintaining a Written Information Security Plan (WISP) for Data Safety
With the rise of data security incidents, businesses are encouraged to maintain a Written Information Security Plan.
Security During Natural Disasters
The Internal Revenue Service (IRS) emphasizes the importance of safeguarding tax and financial information as part of disaster preparedness.
OCR Updates Guidance on HIPAA Tracking Technologies
Department of Health and Human Services (HHS) recently revised its guidance on the use of online tracking technologies by Health Insurance Portability and Accountability Act...
CISA’s Free Cybersecurity Resources
CISA offers cybersecurity tools along with a database of free resources to help employers bolster their security posture.
IRS Dirty Dozen: Phishing and Smishing
The IRS has launched its annual Dirty Dozen campaign, urging taxpayers to beware evolving phishing and smishing scams targeting sensitive taxpayer information.
IRS Warns of Tax Scams in Annual Dirty Dozen List
The Internal Revenue Service (IRS) has launched its annual Dirty Dozen list, cautioning taxpayers about evolving phishing and smishing scams aimed at stealing sensitive...
Recent Healthcare Security Incident
HR departments doing business with UnitedHealth Group (UHG) are probably aware of the cyber incident experienced by the company.
OCR Reports to Congress on HIPAA Compliance and Breaches of Unsecured Protected Health Information
Department of Health & Human Services Office for Civil Rights (OCR) recently issued two reports to Congress on Health Insurance Portability and Accountability Act of 1996...
Enhancing Cybersecurity: New Guidance for HIPAA Compliance and Risk Management
The Department of Health and Human Services (HHS) and the National Institute of Standards and Technology (NIST) released new guidance, SP 800-66 Revision 2, aimed at...
HIPAA Breach Sparked by Rogue Employee
Employers should monitor security protocol for employees with access to personal data.
Another Compliance Date - HIPAA Breach Notifications Due Today!
Covered entities experiencing a breach of unsecured protected health information must report the breach to the OCR.
Prioritizing Security in HR Practices
In today's digital age, prioritizing security is paramount for HR professionals to safeguard sensitive employee data and protect against cyber threats.
HR Guidance: Empowering Your Workforce Against Tax Season Cyber Threats
As tax season approaches, HR professionals take the lead in ensuring their workforce is well-informed and prepared to counter potential online scams and identity theft risks.
Safeguarding Your Work Inbox: A Guide for Click-Wise Employees
In the ever-evolving landscape of cybersecurity, HR professionals play an important role in fostering a culture of vigilance among employees.
Safeguarding HR Data in Secure Online Storage
Human Resources data serves as the lifeblood of organizational operations and ensuring its security is non-negotiable.
Guarding the Gateway: The Importance of Securing Employee Passwords
In the digital age, where technology serves as the backbone of organizational operations, the significance of robust cybersecurity practices cannot be overstated.
Mitigating Security Risks: HR's Guide to PDF Document Safety
HR departments should alert employees to the security risks of clicking on unsolicited PDF attachments.
HIPAA Resolution Agreement for Phishing Cyberattack
Department of Health and Human Services' (HHS) Office for Civil Rights (OCR) reached a resolution agreement involving a phishing cyberattack.
QR Codes: Unveiling the Security Risks You Need to Know
In the age of technological advancements, QR codes have become ubiquitous in streamlining processes and enhancing user experiences.
VPN for Company Security
A virtual private network (VPN) is important to protect against cyber intruders when working remotely.
HHS Settlement: HIPAA Violations upon Ransomware Attack
Department of Health and Human Services (HHS) entered into a settlement agreement on October 31, 2023 with a Massachusetts-based medical management company.
Boosting Cyber Resilience: A Business Continuity Solution
Information was released to help organizations quickly and securely restore critical business functions after a cyber incident.
New #StopRansomware Guide: Strengthening Cybersecurity Defense
A comprehensive guide gives employers strategies to safeguard against ransomware attacks.
AI Regulations Coming
The Biden Administration issued a first-of-its-kind Executive Order addressing artificial intelligence (AI).
New Guidance from Leading Agencies: Combat Phishing Attacks Effectively
Keep your information protected with MyEnroll 360 In a collaborative effort, the Cybersecurity Infrastructure and Security Agency (CISA), the National Security Agency (NSA),...
NIST's Revised Guidelines: Enhancing Healthcare Cybersecurity Compliance
As guardians of employees' well-being, employers know the critical importance of safeguarding healthcare data.
Cybersecurity Awareness Month: Protecting the Digital Frontier
October is Cybersecurity Awareness Month. Learn how to get involved in protecting your digital world.
HIPAA Compliance Made Simple: An Updated Risk Assessment Tool
The U.S. Department of Health and Human Services updated its risk assessment tool to help with compliance.
Protecting Your Workplace: A Warning to HR Professionals and Employees About the Dangers of Phishing Emails
HR professionals play a pivotal role in safeguarding their workplace against potential phishing cyberattacks.
Web-Surfing Security: Teaching Employees Safe Online Practices
As HR professionals, it's crucial to equip employees with the knowledge and tools to navigate the online world safely.
Enhancing Security with Multi-Factor Authentication in MyEnroll360
Learn how MyEnroll360 employs Multi-Factor Authentication (MFA) for enhanced security
Government Urges Adoption of Strong Cyber Authentication Processes
Maintaining robust authentication processes is important for thwarting cyber attacks.
Strengthening Data Security: Essential Measures for HR Professionals and Group Insurance Brokers
Safeguarding sensitive employee information, personal data, and confidential business records is crucial to protect against cyber threats.
Enhancing Data Security: Annual Privacy Training for Employees at BAS
BAS prioritizes data security through its annual privacy and security refresher training for employees.
SEC Mandates Swift Cybersecurity Incident Disclosure: What Public Employers Need to Know
The SEC's latest rules require cybersecurity transparency for publicly held companies and registered investment advisors.
Protecting Against Spear Phishing: Crucial Measures for HR Professionals and Group Insurance Brokers
Defend against sophisticated spear phishing attacks. Stay vigilant with awareness training & robust defenses. Safeguard your business now!
Enhancing Security with MyEnroll360's Multifactor Authentication
MyEnroll360's multifactor authentication system provides enhanced security for HR professionals and employees. Learn more about its benefits today!