Practical articles on HIPAA rules, HITRUST certification, enforcement, and healthcare data protection.
Regulatory FrameworkThe Question at Hand You ve completed your HIPAA Risk Analysis . You filed it away, checked the box, and moved on. But here s the debate: Should you treat your risk assessment as an annual deliverable
Breach NotificationThese myths persist because third-party risk management sits between your security team s control and your vendors promises. When ShinyHunters claimed the theft of 284 million records from McKesson th
Regulatory FrameworkWhat Changed Security Risk Assessments (SRAs) have transformed from annual compliance exercises into strategic tools. In 2024, many organizations treated SRAs as a once-a-year task, resulting in repor
Governance & WorkforceYou ve downloaded a compliance plan template, filled in your organization s name, and filed it under Regulatory Requirements. If that sounds familiar, you re not alone. Many healthcare organizations t
Get weekly security insights and compliance updates delivered to your inbox.
Regulatory FrameworkPurpose of the Template Your audit logs don t prove compliance until someone reviews them. This template provides a structure to track, store, and analyze activity records required under 45 C.F.R. § 1
Regulatory FrameworkWhat Changed Federal HIPAA guidance has long required periodic risk assessments, leaving compliance teams guessing. This ambiguity is ending as states like Texas enforce stricter regulations. The Texa
Regulatory FrameworkFailing to conduct a proper and documented Risk Analysis is the top finding in HHS audits. This crucial requirement of the HIPAA Security Rule isn t just about firewalls or encryption. It s about prov
De-identification & PHI TypesScope - What This Guide Covers This guide explains how to implement system hardening to protect Electronic Protected Health Information (ePHI) under the HIPAA Security Rule . You ll find requirement m
Regulatory FrameworkWhy This Matters You ve signed a Business Associate Agreement with Microsoft and assume OneDrive is compliant. It s not. The BAA means Microsoft secures the infrastructure, but you manage access contr
Regulatory FrameworkIf you sponsor a self-funded health plan, you re a Covered Entity under 45 CFR § 160.103 . This means you have the same HIPAA obligations as a hospital. You re facing a compliance decision: handle eve
De-identification & PHI TypesContext: Questions from the Security Team Huddle During weekly security reviews, incident post-mortems, and budget planning sessions, IT security leads often face a gap between deployed measures and a
Regulatory FrameworkMost healthcare IT teams treat the NIST Cybersecurity Framework as a HIPAA overlay. They download the crosswalk spreadsheet, tick boxes, and call it done. Then they wonder why their security posture h
Regulatory FrameworkYou don t need a breach to fail an audit. A poorly structured Incident Response Plan will do it for you. The HIPAA Security Rule requires a documented Incident Response Plan under 45 CFR § 164.308(a)(
Regulatory FrameworkIf you re managing compliance for a healthcare technology vendor or business associate, you re likely juggling separate HIPAA and SOC 2 programs. This often means different documentation, audit schedu
Regulatory FrameworkThe Challenge In October 2024, the Office for Civil Rights (OCR) launched its Risk Analysis Initiative. By February 2026, it had announced its 11th and 12th enforcement actions under the program. The
Regulatory FrameworkYour annual Risk Assessment is complete. Staff training is done. You ve checked the boxes, updated your policies, and filed everything away. You re compliant, right? Not according to the Office for Ci
Regulatory FrameworkWhat changed: The 2013 HHS Omnibus Rule established a 50-year protection period for deceased individuals Protected Health Information (PHI), replacing the previous indefinite timeline. This change cre
Regulatory FrameworkThe Shared Responsibility Model is no longer just a concept. When you sign a BAA with AWS , Azure , or Google Cloud , you re entering a contract that divides compliance duties. Your provider secures t
HITRUST CSF & ScoringYou re facing a question that sounds binary but isn t: which assurance framework does your organization actually need? The answer depends on three variables: who you serve, what data you handle, and h
Regulatory FrameworkThe Conventional Wisdom Ask any compliance officer about AI and HIPAA, and you ll hear the same checklist: Get the enterprise tier, sign the BAA, turn off model training. Done. This approach has becom
