Practical articles on HIPAA rules, HITRUST certification, enforcement, and healthcare data protection.
Individual RightsA ransomware attack doesn t end when you restore your systems. DaVita s $15 million settlement following an April 2025 incident that exposed information belonging to nearly 2.4 million people shows ho
Breach NotificationWhen a cancer treatment device maker like Novocure becomes the target of a data extortion gang, it shows that your organization s size and specialization won t protect you. Novocure discovered unautho
Breach NotificationOn December 18, 2025, Aesto Health discovered unauthorized access to its AWS infrastructure. By the time the Birmingham-based healthcare technology company completed its investigation and notified aff
Breach NotificationThese myths persist because third-party risk management sits between your security team s control and your vendors promises. When ShinyHunters claimed the theft of 284 million records from McKesson th
Get weekly security insights and compliance updates delivered to your inbox.
Regulatory FrameworkPurpose of the Template Your audit logs don t prove compliance until someone reviews them. This template provides a structure to track, store, and analyze activity records required under 45 C.F.R. § 1
Regulatory FrameworkWhat Changed Federal HIPAA guidance has long required periodic risk assessments, leaving compliance teams guessing. This ambiguity is ending as states like Texas enforce stricter regulations. The Texa
Regulatory FrameworkFailing to conduct a proper and documented Risk Analysis is the top finding in HHS audits. This crucial requirement of the HIPAA Security Rule isn t just about firewalls or encryption. It s about prov
Regulatory FrameworkWhat changed: The 2013 HHS Omnibus Rule established a 50-year protection period for deceased individuals Protected Health Information (PHI), replacing the previous indefinite timeline. This change cre
Regulatory FrameworkThe question divides compliance teams every time a new AI tool arrives in a department manager s inbox. One side argues you can t afford to wait for perfect vendor paperwork while your competitors aut
Regulatory FrameworkYou ve signed Business Associate Agreements with every vendor who touches Protected Health Information (PHI). Your contracts include all the required HIPAA language. You re covered, right? Not even cl
Regulatory FrameworkThe Challenge New Vision Dental faced a common issue: negative patient reviews that needed addressing. A team member responded publicly, revealing patients full names and details not mentioned by the
Breach NotificationDAP Health s $1.3 million settlement following a 2024 email server breach affecting 129,048 individuals highlights a harsh reality for nonprofit healthcare organizations: breach response costs often f
