Businesses are responsible for protecting health information or PII in their care, custody, and control. When medical care and benefits are inadvertently given to a thief, the medical provider must work closely with the patient and insurance company to repair the damage. Medical providers must report any fraud to the HHS OIG office every year. Companies can face federal and state fines for not alerting the proper authorities of fraud events. Businesses are responsible for protecting health information or PII in their care, custody, and control. When medical care and benefits are inadvertently given to a thief, the medical provider must work closely with the patient and insurance company to repair the damage. Medical providers must report any fraud to the HHS OIG office every year. Companies can face federal and state fines for not alerting the proper authorities of fraud events.