Practical articles on HIPAA rules, HITRUST certification, enforcement, and healthcare data protection.
Regulatory FrameworkThese questions arise from real conversations among compliance officers and IT security leads after reading about settlement announcements. The Boston Children s Health Physicians (BCHP) and XTIUM cas
Regulatory FrameworkA phishing email cost Ambry Genetics $700,000 in regulatory penalties and $12.25 million in lawsuit settlements. The breach exposed 225,370 individuals ePHI over three days in January 2020. However, t
Regulatory FrameworkUnderstanding the Compliance Challenge Your business associate just informed you they re hiring a freelance developer to build a patient portal feature. Your privacy officer wants to know if the exist
Regulatory FrameworkTracking technologies present compliance risks that your legal and IT teams have likely warned you about. Yet, Covered Entities and Business Associates often make preventable mistakes when using analy
Get weekly security insights and compliance updates delivered to your inbox.
Regulatory FrameworkIf you sponsor a self-funded health plan, you re a Covered Entity under 45 CFR § 160.103 . This means you have the same HIPAA obligations as a hospital. You re facing a compliance decision: handle eve
Regulatory FrameworkIf you re managing compliance for a healthcare technology vendor or business associate, you re likely juggling separate HIPAA and SOC 2 programs. This often means different documentation, audit schedu
Regulatory FrameworkYour Business Associate Agreement (BAA) stack probably contains at least one contract that s putting you at risk right now. Not because the vendor is malicious, but because the agreement itself is inc
Regulatory FrameworkA whistleblower report lands in your compliance inbox. You have 120 days to investigate, decide whether to self-disclose to the Department of Justice (DOJ) , and document every step. This is the opera
Regulatory FrameworkYour marketing team wants to launch a patient engagement campaign. Your IT lead is worried about encryption. Your privacy officer is asking whether you need authorization. And someone from billing jus
