Practical articles on HIPAA rules, HITRUST certification, enforcement, and healthcare data protection.
De-identification & PHI TypesScope - What This Guide Covers This guide explains how to implement system hardening to protect Electronic Protected Health Information (ePHI) under the HIPAA Security Rule . You ll find requirement m
Regulatory FrameworkWhy This Matters You ve signed a Business Associate Agreement with Microsoft and assume OneDrive is compliant. It s not. The BAA means Microsoft secures the infrastructure, but you manage access contr
Regulatory FrameworkIf you sponsor a self-funded health plan, you re a Covered Entity under 45 CFR § 160.103 . This means you have the same HIPAA obligations as a hospital. You re facing a compliance decision: handle eve
De-identification & PHI TypesContext: Questions from the Security Team Huddle During weekly security reviews, incident post-mortems, and budget planning sessions, IT security leads often face a gap between deployed measures and a
Get weekly security insights and compliance updates delivered to your inbox.
Regulatory FrameworkMost healthcare IT teams treat the NIST Cybersecurity Framework as a HIPAA overlay. They download the crosswalk spreadsheet, tick boxes, and call it done. Then they wonder why their security posture h
Regulatory FrameworkYou don t need a breach to fail an audit. A poorly structured Incident Response Plan will do it for you. The HIPAA Security Rule requires a documented Incident Response Plan under 45 CFR § 164.308(a)(
Regulatory FrameworkIf you re managing compliance for a healthcare technology vendor or business associate, you re likely juggling separate HIPAA and SOC 2 programs. This often means different documentation, audit schedu
Regulatory FrameworkThe Challenge In October 2024, the Office for Civil Rights (OCR) launched its Risk Analysis Initiative. By February 2026, it had announced its 11th and 12th enforcement actions under the program. The
Regulatory FrameworkYour annual Risk Assessment is complete. Staff training is done. You ve checked the boxes, updated your policies, and filed everything away. You re compliant, right? Not according to the Office for Ci
Regulatory FrameworkWhat changed: The 2013 HHS Omnibus Rule established a 50-year protection period for deceased individuals Protected Health Information (PHI), replacing the previous indefinite timeline. This change cre
Regulatory FrameworkThe Shared Responsibility Model is no longer just a concept. When you sign a BAA with AWS , Azure , or Google Cloud , you re entering a contract that divides compliance duties. Your provider secures t
HITRUST CSF & ScoringYou re facing a question that sounds binary but isn t: which assurance framework does your organization actually need? The answer depends on three variables: who you serve, what data you handle, and h
Regulatory FrameworkThe Conventional Wisdom Ask any compliance officer about AI and HIPAA, and you ll hear the same checklist: Get the enterprise tier, sign the BAA, turn off model training. Done. This approach has becom
Regulatory FrameworkYour Business Associate Agreement (BAA) stack probably contains at least one contract that s putting you at risk right now. Not because the vendor is malicious, but because the agreement itself is inc
Regulatory FrameworkQuestions IT security teams ask about HIPAA-compliant cloud backup IT security leads often find themselves tasked with finding a backup solution, only to realize that HIPAA-compliant doesn t mean what
Regulatory FrameworkYou ve implemented encryption, configured your firewalls, and set up access controls. But when the Office for Civil Rights (OCR) requests evidence of your HIPAA Security Rule program, can you produce
Regulatory FrameworkThe question divides compliance teams every time a new AI tool arrives in a department manager s inbox. One side argues you can t afford to wait for perfect vendor paperwork while your competitors aut
OCR Enforcement & PenaltiesThe Challenge You ve received formal notice from the Office for Civil Rights : your organization must execute a corrective action plan (CAP). The investigation is over, the deficiencies are documented
Regulatory FrameworkYou ve been tasked with implementing HIPAA compliance from scratch. Your CFO wants a timeline, your IT team needs specifics, and you re staring at vendor proposals that range from $500 to $50,000 annu
Administrative SafeguardsYou re 45 minutes into a ransomware event. Your EHR is locked. Clinical staff are asking whether to activate downtime procedures. Your MSP is on the phone. Your CFO wants to know if you should pay. An
