Practical articles on HIPAA rules, HITRUST certification, enforcement, and healthcare data protection.
Breach NotificationYou ve hardened your perimeter, run quarterly vulnerability scans, and have a vendor risk management program. So you re protected from class action litigation after a breach, right? Not even close. Th
Breach NotificationScope This guide outlines the legal and operational steps your organization must take when a data breach leads to class action litigation. You ll learn about the regulatory framework, timeline require
Breach NotificationHealthcare organizations often practice breach response procedures, conduct tabletop exercises, and maintain incident response plans. Yet, operational failures still appear in settlement after settlem
Breach NotificationScope This guide focuses on the technical controls and operational practices your team needs to implement in response to the 239% increase in hacking-related healthcare data breaches from January 2018
Get weekly security insights and compliance updates delivered to your inbox.
Breach NotificationUnderstanding the Impact of Breach Settlements When MCNA settled its class action lawsuit for a 2023 data breach affecting 8.9 million individuals, compliance officers were eager to understand the imp
Breach NotificationThe Decision at Hand When a data breach leads to class action litigation, you must decide whether to settle quickly or contest the claims in court. Highlands Oncology Group opted for settlement after
Breach NotificationWhen The Gentlemen ransomware group exfiltrated data from Nutex Health s servers in August 2026, the Houston-based healthcare company faced a significant cybersecurity incident. The attack followed a
Breach NotificationThe Conventional Wisdom Walk into any compliance conference and you ll hear the same refrain: We need better security awareness training. A phishing incident occurs, and the solution is another mandat
Regulatory FrameworkIf you re responsible for protecting sensitive information in healthcare, you ve likely been told you need to comply with HIPAA . You may also have heard that NIST guidelines offer a more robust techn
Regulatory FrameworkWhat Changed Security Risk Assessments (SRAs) have transformed from annual compliance exercises into strategic tools. In 2024, many organizations treated SRAs as a once-a-year task, resulting in repor
Governance & WorkforceYou ve downloaded a compliance plan template, filled in your organization s name, and filed it under Regulatory Requirements. If that sounds familiar, you re not alone. Many healthcare organizations t
De-identification & PHI TypesScope - What This Guide Covers This guide explains how to implement system hardening to protect Electronic Protected Health Information (ePHI) under the HIPAA Security Rule . You ll find requirement m
Regulatory FrameworkYour annual Risk Assessment is complete. Staff training is done. You ve checked the boxes, updated your policies, and filed everything away. You re compliant, right? Not according to the Office for Ci
Regulatory FrameworkThe Conventional Wisdom Ask any compliance officer about AI and HIPAA, and you ll hear the same checklist: Get the enterprise tier, sign the BAA, turn off model training. Done. This approach has becom
Regulatory FrameworkYou ve implemented encryption, configured your firewalls, and set up access controls. But when the Office for Civil Rights (OCR) requests evidence of your HIPAA Security Rule program, can you produce
Regulatory FrameworkYour incident response plan is documented, signed, and passed your last audit. But when a workstation starts encrypting files at 3 a.m., will anyone know what to do? Most healthcare organizations fail
De-identification & PHI TypesThese questions arise from the gap between vendor marketing and operational reality. Your procurement team sees a HIPAA compliant badge. Your privacy officer asks what that means for the appointment r
Regulatory FrameworkYou don t need a law degree to meet HIPAA requirements. The regulation reads like legal code because it is, but the work it demands, risk analysis, policies, training, vendor agreements, is operationa
Regulatory FrameworkThe Question at Hand You re facing the Security Rule s foundational requirement: a comprehensive, organization-wide risk analysis under 45 CFR § 164.308(a)(1)(ii)(A) . The question isn t whether you n
Regulatory FrameworkYou ve opened the email or certified letter from the Office for Civil Rights (OCR) , and your stomach drops. An investigation has been opened. What you do in the next 72 hours will determine whether t
