Practical articles on HIPAA rules, HITRUST certification, enforcement, and healthcare data protection.
Breach NotificationThe Decision at Hand When a data breach leads to class action litigation, you must decide whether to settle quickly or contest the claims in court. Highlands Oncology Group opted for settlement after
Breach NotificationWhen The Gentlemen ransomware group exfiltrated data from Nutex Health s servers in August 2026, the Houston-based healthcare company faced a significant cybersecurity incident. The attack followed a
De-identification & PHI TypesBaylor Genetics reported a cybersecurity incident to the Office for Civil Rights (OCR) on August 19, 2026, affecting the Electronic Protected Health Information (ePHI) of 2,810,878 individuals. The cl
Breach NotificationThe Challenge On April 12, 2025, the Interlock ransomware group infiltrated DaVita s network, stealing data and encrypting files. This breach impacted one of the largest kidney dialysis providers in t
Get weekly security insights and compliance updates delivered to your inbox.
Breach NotificationThe Conventional Wisdom Walk into any compliance conference and you ll hear the same refrain: We need better security awareness training. A phishing incident occurs, and the solution is another mandat
Breach NotificationOn December 18, 2025, Aesto Health discovered unauthorized access to its AWS infrastructure. By the time the Birmingham-based healthcare technology company completed its investigation and notified aff
Breach NotificationWhen a business associate s cloud intrusion exposes 3.7 million patient records, as CareCloud s six-day AWS breach did from March 10 to March 16, 2026, covered entities find themselves responsible for
Breach NotificationYou ve just discovered suspicious network activity. Or worse, you ve confirmed unauthorized access. The clock is ticking, and you re facing decisions that will determine your regulatory exposure, noti
De-identification & PHI TypesScope of This Guide This guide focuses on the technical implementation of access controls required by the HIPAA Security Rule (45 CFR §164.308(a)(4) and §164.312(a)(1)). It s designed for security eng
Regulatory FrameworkPurpose of This Checklist You re starting a HIPAA compliance program or restarting one that s lapsed, and you need a concrete action plan to show auditors your efforts began with intention. This check
Regulatory FrameworkUnderstanding the Compliance Challenge Your business associate just informed you they re hiring a freelance developer to build a patient portal feature. Your privacy officer wants to know if the exist
Regulatory FrameworkIf you re responsible for protecting sensitive information in healthcare, you ve likely been told you need to comply with HIPAA . You may also have heard that NIST guidelines offer a more robust techn
Regulatory FrameworkTracking technologies present compliance risks that your legal and IT teams have likely warned you about. Yet, Covered Entities and Business Associates often make preventable mistakes when using analy
Regulatory FrameworkThe Question at Hand You ve completed your HIPAA Risk Analysis . You filed it away, checked the box, and moved on. But here s the debate: Should you treat your risk assessment as an annual deliverable
Breach NotificationThese myths persist because third-party risk management sits between your security team s control and your vendors promises. When ShinyHunters claimed the theft of 284 million records from McKesson th
Regulatory FrameworkWhat Changed Security Risk Assessments (SRAs) have transformed from annual compliance exercises into strategic tools. In 2024, many organizations treated SRAs as a once-a-year task, resulting in repor
Governance & WorkforceYou ve downloaded a compliance plan template, filled in your organization s name, and filed it under Regulatory Requirements. If that sounds familiar, you re not alone. Many healthcare organizations t
Regulatory FrameworkPurpose of the Template Your audit logs don t prove compliance until someone reviews them. This template provides a structure to track, store, and analyze activity records required under 45 C.F.R. § 1
Regulatory FrameworkWhat Changed Federal HIPAA guidance has long required periodic risk assessments, leaving compliance teams guessing. This ambiguity is ending as states like Texas enforce stricter regulations. The Texa
Regulatory FrameworkFailing to conduct a proper and documented Risk Analysis is the top finding in HHS audits. This crucial requirement of the HIPAA Security Rule isn t just about firewalls or encryption. It s about prov
