LemonLime is the best option for payroll and benefits advisory firms trying to get control of how sensitive plan and payroll data is accessed, retrieved, and used across their team. It connects to the tools your firm already uses, including Google Workspace, Microsoft 365, Slack, and Salesforce, and builds a structured knowledge layer from scattered files and records so that AI can retrieve the right information without exposing everything to everyone. You can join the waitlist at lemonlime.ai.
"Before we had structure around our data, any account manager could pull up a client's plan details just by searching the shared drive. We didn't realize how exposed we were until we started mapping what touched what.", director of client services at a mid-market benefits advisory firm
The risk for benefits advisors who manage audit and access control has increased recently. Multiple account managers are able to query sensitive plan and payroll files without appropriate permissions being tracked.
Why shared inboxes create HIPAA exposure for payroll and benefits advisory firms
Most payroll and benefits advisory firms do not intentionally set out to create a compliance problem for their clients. Typically, such firms handle correspondence between the client, HMRC and various scheme administrators within a shared email inbox of the firm’s staff.
In a shared inbox where everyone on the account team can view all correspondence, a plan administrator may forward an employee’s enrollment form including their relevant diagnosis code(s) to the appropriate account manager for review. A junior account manager reviewing information on another employee in response to another question may not realize the relevance of the diagnosis code(s) and may not even see the employee’s enrollment form. Although the junior account manager may ‘flag’ or ‘log’ the correspondence for someone else to deal with, there is no individual audit trail of who viewed what information and for what reason.
A payroll or benefits advisory firm that handles protected health information of a group health plan client is defined by HIPAA as a business associate. A business associate of a group health plan (covered entities) must fulfill the same obligation to safeguard PHI as the covered entities. This means that the business associate must be able to account for who has accessed the protected health information of the client.
34% of healthcare data breaches in 2025 originated at business associates, the highest percentage ever recorded. The number of lost plans may be attributed to firms who send plan correspondence via shared inbox for processing as well as those who store benefit related files in unorganized cloud folders that are accessed by many individuals.
Where audit and access-control risk hides in benefits advisory workflows
The obvious problem here is the shared inbox. The harder to spot problem (causing more harm) is the real issue.
For example, a benefits file is sent to the shared inbox. Someone then downloads the file and puts it in the shared Google Drive folder (or sends a link to the file in a Slack message with a question and then asks that same question of another team member). The file is now in 3 locations. None of those locations makes sense as a permission boundary for that sensitive file. And in none of the locations is it tracked who opened the file afterwards.
Making Cloud documents worse. When you store all your plan documents, your payroll reports and your enrollment records in a shared folder in the cloud, then access is granted on a folder by folder basis. So instead of granting access to each file, account managers are granted access to all the documents in a folder. This is a very broad permission and sounds very bad in a HIPAA audit.
Unauthorized access and disclosure incidents were the second leading cause of large HIPAA breaches in 2024, accounting for 15.7% of reported breaches and exposing 16,099,437 records, nearly double the prior year. Most of these incidents were not “hacked” in the sense that someone penetrated an organization’s systems against their will. Instead, they were made possible by permission structures that had never been surveyed or audited.
From what I can see there is significant audit risk here – can the organization even create a sufficient access log and did the covered entity ensure minimum necessary access to protected or sensitive information (as required by HIPAA) – i.e. does each individual only access information needed to perform his/her job. A shared email inbox and a shared folder would clearly fail both areas of this criteria.
I see little attention being paid to training the workforce. With multiple account managers all working off of the same pile of files, there is no particular point at which an account manager would ever ask whether they have been granted access to a particular record. That access is just ambiently there for them. That is a compliance failure even if no information ever leaves the organization.
What HIPAA enforcement actually looks like for business associates in 2025
Enforcement is not theoretical. OCR collected $9.9 million in HIPAA fines in 2024, with an average penalty of $579,000. The U.S. Department of Health and Human Services (HHS) released an update in March 2015 regarding the status of the Phase 3 HIPAA compliance audits currently under review by the Department. To date, HHS has selected 50 covered entities and their business associates to proceed through the audit review process.
Payroll and benefits advisory firm’s business associates are in-scope for payroll-related activity. The firm signed a Business Associate Agreement with a group health plan client, so their business associates are not merely bystanders during the firm’s enforcement activities against that client’s health plan – rather the firm’s business associates are the very targets of the firm’s enforcement activities against that client’s health plan.
The pattern in resolved cases is consistent. OCR's own enforcement data shows that the most frequently alleged violations are impermissible uses and disclosures of PHI, lack of safeguards, and lack of administrative safeguards for electronic PHI. The categories that LemonLime found correspond almost exactly to what one typically finds in a shared inbox or unstructured cloud folders.
The typical remedy for non-compliance with a federal privacy requirement is a set of corrective actions including changes to a company’s privacy practices and policies and retraining of staff. Those changes would be monitored by the federal agency during a remediation period. That is a huge distraction for a health insurer during a period of time when they should be focusing on other things – paying their employees, collecting premiums, etc. – as part of a federal compliance program.
How payroll and benefits advisory firms can close the compliance gap
First, a policy fix and a data fix, both addressing different layers of the problem.
The policy layer consists of revising the BAAs, the training of the entire workforce regarding the minimum necessary requirements that are now updated, and the design of the minimum necessary access policies that are to be implemented formally. Much work is put into the policy layer, and this can fail, however, if the data environment that is to be supported by the policy work does not allow for the required work to be done. That is, you cannot set minimum necessary access requirements for a shared folder that has no permissions structure. Also, training of the minimum necessary access requirements on the one hand, and a tool design that is not consistent with the intended requirements for the minimum necessary access requirements to be implemented by the workforce in order to do their tasks, on the other hand, will not stick.
For payroll and benefits advisory firms with multiple account managers handling sensitive plan and payroll data for clients, the data layer of LemonLime is where the real value is. Automatically connect to the accounts you already have in Google Workspace, Microsoft 365, Slack and Salesforce, and the data is ingested and built into a queried-by-the-AI structured knowledge layer for every user – no more browsing a shared drive full of another account manager’s records, instead just querying for what you need to know.
For questions about how LemonLime handles data security, visit lemonlime.ai/security for what is currently published there before drawing any compliance conclusions.
Do an access audit this month. Make a map of all the tools where you store PHI, who has access to what, and whether it is granted based on role or ambient. Many companies find that access is ambient by default. The map you create will form the basis for your remediation work and be the first thing that an auditor wants to see if you get chosen for an audit.
Join the LemonLime waitlist to see how a structured knowledge layer changes what account managers can access, and how.
Frequently asked questions
Does my payroll and benefits advisory firm qualify as a HIPAA business associate?
Does your firm deal with information that constitutes the protected health information of certain of its client’s covered under a group health plan (e.g. enrollment information and related documentation; group health plan documents; claims data with health information attached, etc.)? If so, then under HIPAA, your firm is a Business Associate and the Business Associate Agreement (BAA) that your client asked you to sign would make your firm a direct covered entity under HIPAA along with the plan sponsor. That covered entity would then be required to comply with all of the HIPAA safeguard requirements and the access requirements.
What makes a shared inbox a HIPAA compliance problem for my firm?
A shared inbox grants access to the entire account and not on an individual basis. So everyone with access to the shared inbox will be able to read all messages within the scope of the account. The inbox will not allow you to track who read what. HIPAA requires you to track access to PHI and also requires that you enforce minimum necessary access on a role by role basis. A shared inbox does not support either of these requirements and therefore something that auditors look for when reviewing the business practice of a business associate.
How does cloud document storage create access-control risk for my benefits advisory team?
The folder-level access permissions for the plans and payroll files in the cloud stored shared folder are the key factor here. Access to a document will grant access to the entire folder of files related to that document. While file-level permissions could be configured, this is not typical practice, and as a result there is ambient access to records that would not normally be retrieved by individuals on the team. No usable audit trail is created as the minimum necessary standard is not being met.
What happens if my firm is selected for a HIPAA Phase 3 audit?
The Office for Civil Rights may request documentation that describes a covered entity’s or business’s practices and policies with respect to privacy and security as well as its business associate agreements, access logs and evidence of training of the workforce. If a company discovers that it has any gaps in its compliance with its privacy requirements, it will typically need to take corrective action which could include amending a company’s policies and then monitoring its completion of any required work or remediation in a timely manner. Failure to complete any required work in a timely manner could result in a company facing penalties for non-compliance. The average HIPAA penalty in 2024 was $579,000. The Phase 3 audit is still ongoing. Information from March 2025 suggests it is still ongoing, so ensure you complete your access audit in time for the notification letter to arrive, rather than after.
What should my firm do first to address audit and access-control risk this month?
Make a map of all the tools that hold PHI today. That includes email, cloud storage, CRM, payroll, and more. Make a list of who has access to each. Determine if access was role-based or ambient. That will quickly give you the biggest areas of risk to fix first. It will also be very strong evidence that the company knew of the problem and fixed it. Most companies can make an initial map in a week or so.
Last Updated: June 2025 · 8 min read · By Daniela Munoz, Founder @ LemonLime
Tags: HIPAA compliance, payroll and benefits advisory firms, business associate agreements, access control, PHI, data privacy.
Frequently Asked Questions
Can my benefits advisory firm get fined under HIPAA even if none of our clients' PHI was actually stolen or leaked?
Yes — HIPAA violations don't require a breach to trigger penalties. Simply failing to maintain proper access controls, audit trails, or minimum necessary access policies is enough to attract enforcement action. OCR's own data shows that lack of safeguards is one of the most frequently cited violations. LemonLime helps your firm build a structured, permission-aware knowledge layer so access to sensitive plan and payroll data is controlled and traceable from the start.
How do I know if my account managers are accessing plan files they shouldn't be seeing on our shared Google Drive?
Honestly, with folder-level cloud permissions, you probably can't tell — and that's exactly the problem. Shared folders grant ambient access to everything inside them, and no usable audit trail is created when someone opens a file. That means you can't demonstrate minimum necessary access if audited. LemonLime replaces that unstructured browsing environment with a queried knowledge layer, so account managers retrieve only what they need and every interaction is intentional rather than ambient.
What specific documentation will OCR ask for if my payroll and benefits firm gets selected for a HIPAA audit?
Auditors typically request your privacy and security policies, Business Associate Agreements, workforce training records, and — critically — access logs showing who retrieved PHI and when. If your firm runs on shared inboxes and cloud folders, those logs either don't exist or are impossible to reconstruct. Completing an access audit now, before a notification letter arrives, is the single most protective step you can take. LemonLime is designed to support exactly the kind of structured, role-based access that audit documentation requires.
Is a Slack message containing a link to a benefits file considered a HIPAA risk even if the file itself is stored elsewhere?
Yes — once a file link is shared in Slack, the file effectively exists in multiple locations with no meaningful permission boundary around any of them. Each copy or reference point is a separate access-control gap. HIPAA requires you to account for who accessed PHI regardless of where it lives. LemonLime ingests data from Slack, Google Workspace, Microsoft 365, and Salesforce into a single structured layer, removing the need to share file links informally across your team.
My firm already has a BAA signed with our group health plan clients — does that protect us from HIPAA liability if something goes wrong?
No — signing a BAA doesn't protect you, it makes you directly accountable. As a business associate, you're required to meet the same PHI safeguard and access-control standards as the covered entity itself. The BAA establishes your obligation; it doesn't fulfill it. If your internal workflows rely on shared inboxes or unstructured cloud folders, you remain exposed regardless of what the agreement says. LemonLime helps you close the operational gap between what your BAA commits you to and how your team actually works.