Articles on HIPAA Security Risk Analysis, MIPS requirements, business associate obligations, and the practical side of healthcare compliance. Written by our founder from fifteen years of doing the work.
OCR has built a numbered series of HIPAA settlements around one requirement, the risk analysis. What investigators found, what the corrective action plans require, and what smaller organizations should take from them.
The 2024 Part 2 final rule is now in force, and OCR is accepting complaints and breach reports. What changed for SUD records, and what programs, hospitals, and their vendors should review now.
HIPAA requires a security awareness and training program for every workforce member but sets no fixed schedule. What the rules require, what the proposed rule would add, and how to build training that changes behavior.
A single yes or no question that earns no points, which is why it gets left until December. What CMS requires for 2026, which guides apply to whom, and how to finish properly before December 31.
It is not final, and final action is now listed for July 2027. What the proposal would require, which pieces are worth starting now, and which can sensibly wait for the final text.
What happened, what the outage did to practices and hospitals, and what a small organization can do now about the vendors it depends on.
Correctional health providers, court-linked behavioral health programs, hospital police, and their vendors often handle criminal justice information without realizing CJIS applies.
The Senate passed S. 3315 by unanimous consent on September 30. What the bill would do, what is actually required today, and five steps worth taking whether or not it becomes law.
For the 2026 performance year the measure asks two questions instead of one, and getting either wrong zeroes out the entire Promoting Interoperability category.
The most cited failure in HIPAA enforcement. The nine elements OCR looks for, and how to tell a real analysis from a document that resembles one.
Vendors use these terms loosely and organizations buy the wrong thing as a result. What each one is, which one HIPAA requires, and what to ask before you sign.
The rule does not give a number. Why annual became the working standard, what MIPS requires, and the events that should trigger a fresh look regardless of the calendar.
Since 2013, vendors handling patient data are directly liable under the Security Rule. Who qualifies, what is required, and the gaps that most often catch companies off guard.