How ConnectWise’s breach tested small practices’ business associate agreements
A nation-state intrusion at a remote access vendor in May 2025 sat two contracts away from most physician practices. Their services and business associate agreements are the only controls they hold, and most say too little about tools, access, notice and cost.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On May 28, 2025, ConnectWise said it had detected suspicious activity in its environment linked to a sophisticated nation-state actor. Its ScreenConnect remote access software is widely used by managed service providers and internal IT teams. The company said the activity had affected a very small number of customers of its cloud-hosted ScreenConnect service. It had engaged Google’s Mandiant unit for forensics, notified affected customers and law enforcement, and strengthened monitoring. It published no detailed technical findings. Security reporters linked the activity to a ScreenConnect vulnerability ConnectWise had patched in April. The disclosure came about fifteen months after a critical ScreenConnect flaw was widely exploited in February 2024, and amid long-running federal warnings that attackers abuse legitimate remote monitoring and management tools.
Most physician groups, ambulatory surgery centers and small specialty practices do not run their own IT. They hire a managed service provider, which reaches into their systems through remote access and monitoring tools. That makes the tooling vendor a supplier two contracts away. The practice signs with the provider, and the provider licenses the tools. A practice cannot audit ConnectWise or any other tooling vendor. It can only set what the provider must do, through the master services agreement and the HIPAA business associate agreement that sits beside it. Those two documents need to settle four things, and most settle none of them well: which tools touch the practice, how access through them is controlled, what the provider must disclose, and who pays when something goes wrong.
Which tools touch the practice
Many practices cannot name the remote access and monitoring tools on their machines. Providers often run more than one, switch tools over time, and leave old agents installed after a migration. Clinical device vendors add their own. Each agent is a path in. An attacker who controls a provider’s console, or the vendor’s cloud service behind it, can reach every client at once.
The services agreement should require the provider to keep a current list of every remote tool it uses in the practice’s environment, including whether each is vendor-hosted or self-hosted. It should require notice before tools are added or changed, and removal of agents no longer in use. Third-party agents should be on the list too: imaging, lab and EHR vendors often maintain their own remote access. This is a short clause with a large effect. When a tooling vendor announces an incident, the practice can tell within an hour whether it is exposed.
The list has a second use. Cyber insurers increasingly ask applicants which remote access tools are in use and how they are secured. A practice that cannot answer accurately risks a misstatement on its application, which can complicate a later claim. The provider’s tool list, kept current under contract, is the evidence behind that answer.
How access is controlled
Remote tools are only as safe as the accounts that use them. The agreement should require phishing-resistant multifactor authentication for every technician, named accounts rather than shared logins, and separation so that one client’s compromise does not open another. It should also require session recording or logging the practice can obtain on request. Where the console is hosted by the tooling vendor, the provider should explain how that console is protected and patched.
None of this is exotic. It mirrors federal guidance on remote monitoring and management tools that CISA and its partners have published since 2023. The difference is enforceability. A practice with these terms in writing can ask for evidence, such as an access review or a log sample, instead of accepting assurances. Asking once a year, at renewal, costs little and signals that the practice reads the reports it receives.
What the provider must disclose
A managed service provider with access to electronic protected health information is generally a business associate under HIPAA. It must sign a business associate agreement and report security incidents and breaches of unsecured protected health information to the practice. Whether a tooling vendor is a subcontractor business associate depends on its role, and practices should check that with counsel.
The gap is timing and scope. HIPAA allows up to 60 days after discovery to notify a covered entity of a breach, and many template agreements narrow incident reporting to confirmed breaches. A suspicious-activity notice from a tooling vendor may meet neither trigger, yet it is exactly when the practice needs to act: rotate credentials, review sessions, check for new accounts. The agreement should require the provider to tell the practice within a short, fixed period of any security incident at the provider or at a vendor whose tools touch the practice. It should require sharing what the provider knows and cooperation with the practice’s own investigation and insurer.
Who pays
Managed service contracts for small healthcare organizations commonly cap the provider’s liability at a few months of fees and exclude consequential damages. That may suit routine service failures. For an incident that starts in the provider’s tools, it leaves the practice holding nearly all of the cost: forensics, notification, downtime, lost visits and regulatory response.
Small practices have limited bargaining power, but they have options. They can ask what cyber insurance the provider carries and whether clients benefit from it. They can negotiate a higher cap that applies only to security incidents caused by the provider’s tools or negligence. They can make notice and cooperation duties survive termination. They should also confirm that their own cyber policy covers incidents originating at a service provider, because some policies treat these differently. Counsel and the insurance broker belong in this conversation.
Applying these four terms does not require a new negotiation every year. A one-page security schedule, attached to the services agreement and referenced in the business associate agreement, can carry all of them. It can be reused at every renewal and across every practice in a group.
With hindsight
ConnectWise never published a full account of the intrusion. In June 2025 it rotated the code-signing certificates for ScreenConnect, Automate and its RMM agents, citing concerns a third-party researcher had raised about how older ScreenConnect versions handled configuration data. It said that issue did not involve a compromise of its systems or certificates. Customers running self-hosted versions had to update before the cutoff. Federal advisories through 2025 and 2026 continued to describe attackers using legitimate remote access tools.
On the regulatory side, the HIPAA Security Rule overhaul that HHS proposed in January 2025 would require covered entities to obtain written verification, at least annually, that business associates have deployed required technical safeguards. As of late 2026 it had not been finalized, and federal planning documents projected final action in 2027. Practices that wrote verification and notice terms into their agreements in 2025 have, in effect, already adopted much of that proposal.