Practical articles on HIPAA rules, HITRUST certification, enforcement, and healthcare data protection.
Breach NotificationThird-party vendors were responsible for 32% of healthcare breaches, highlighting risks in vendor security amid new mandatory healthcare cybersecurity standards.
OCR Enforcement & PenaltiesOCR logged over 374,000 HIPAA email complaints, mostly about PHI disclosures and security gaps. Strong risk analysis and documentation help prevent violations.
Regulatory FrameworkThese questions arise from real conversations among compliance officers and IT security leads after reading about settlement announcements. The Boston Children s Health Physicians (BCHP) and XTIUM cas
Breach NotificationWhen Millstone Medical Outsourcing detected suspicious activity on December 16, 2025, it launched an investigation. Nine months later, in September 2026, it disclosed a breach affecting Social Securit
Get weekly security insights and compliance updates delivered to your inbox.
Breach NotificationWhen Oracle Health disclosed a breach affecting legacy Cerner systems in 2025, the initial report to federal regulators listed 501 patients. By October 2026, that number had climbed to 20 million. Thi
Breach NotificationYou ve just received a breach notification from one of your Business Associates . Or maybe you re reviewing your vendor list and wondering which relationships deserve immediate attention. Either way,
Breach NotificationThird parties now account for 32% of healthcare breaches, according to Verizon s 2026 Data Breach Investigations Report . Seven of the ten largest breaches in the first half of 2026 involved a busines
Breach NotificationThe Challenge OneTouchPoint Corp., a Wisconsin-based printing and mailing services vendor, discovered encrypted files on its network on April 28, 2022. A forensic investigation traced the intruder s f
Breach NotificationThe Conventional Wisdom When a Business Associate suffers a massive breach, compliance teams often feel secure if they have a signed Business Associate Agreement (BAA). The thinking is: we ve done our
Regulatory FrameworkA phishing email cost Ambry Genetics $700,000 in regulatory penalties and $12.25 million in lawsuit settlements. The breach exposed 225,370 individuals ePHI over three days in January 2020. However, t
Breach NotificationYou ve signed the business associate agreement. Your vendor passed the initial security questionnaire. You re confident that the third party managing your legacy EHR data won t become a liability. The
Breach NotificationContext: Questions from the Front Lines These questions arise from real conversations with business associate compliance teams following the AdaptHealth breach disclosure. When a social engineering at
Breach NotificationIn June 2026, 66 large healthcare data breaches affected at least 4,499,972 individuals. The numbers tell a clear story: hacking incidents at Business Associates now dominate, accounting for 81.8% of
Breach NotificationThe breach at Aesto Health wasn t just a cloud issue. It was a single AWS compromise that affected over two dozen healthcare providers, exposing data for more than 9.5 million patients. When you outso
Breach NotificationWhen a business associate s cloud intrusion exposes 3.7 million patient records, as CareCloud s six-day AWS breach did from March 10 to March 16, 2026, covered entities find themselves responsible for
Regulatory FrameworkUnderstanding the Compliance Challenge Your business associate just informed you they re hiring a freelance developer to build a patient portal feature. Your privacy officer wants to know if the exist
Regulatory FrameworkTracking technologies present compliance risks that your legal and IT teams have likely warned you about. Yet, Covered Entities and Business Associates often make preventable mistakes when using analy
Regulatory FrameworkIf you sponsor a self-funded health plan, you re a Covered Entity under 45 CFR § 160.103 . This means you have the same HIPAA obligations as a hospital. You re facing a compliance decision: handle eve
Regulatory FrameworkIf you re managing compliance for a healthcare technology vendor or business associate, you re likely juggling separate HIPAA and SOC 2 programs. This often means different documentation, audit schedu
Regulatory FrameworkYour Business Associate Agreement (BAA) stack probably contains at least one contract that s putting you at risk right now. Not because the vendor is malicious, but because the agreement itself is inc
