10 min read
Is Microsoft 365 HIPAA Compliant? BAA & Setup Guide
Yes, with a business or enterprise plan, the automatic BAA, and correct configuration. The BAA is the easy part. Setup is where practices slip.
Featured
HIPAA Incident Management: Complete Guide for Healthcare Orgs
How to identify, document, assess, and respond to HIPAA security incidents. Covers breach determination, notification timelines, and building an effective incident management system.
HIPAA Incident Management: Complete Guide for Healthcare Orgs
Latest Articles
126 articles published
10 min read
9 min read
HIPAA Employee Onboarding Checklist for Small Practices
The HIPAA onboarding sequence for a small practice: what to sign, train, assign, and document before a new hire ever touches a patient record.
6 min read
HIPAA Vulnerability Scanning Requirements
HIPAA vulnerability scanning is not required yet. Here is what the proposed Security Rule would mandate: scans every 6 months, annual pen tests, and MFA.
15 min read
We Fact-Checked AccountableHQ Against the HIPAA Regulation
We compared AccountableHQ's content to the HIPAA Administrative Simplification regulation and found 19 substantive accuracy problems, from invented compliance concepts to omitted deadlines.
10 min read
Google's Selfie Sign-In: What Healthcare Teams Need to Know About Biometric Authentication
Google now lets you sign in with a selfie video. Here is what healthcare organizations need to know about biometric authentication, HIPAA compliance, and the risks of cloud-stored facial data.
11 min read
HIPAA Consulting vs Compliance Software: Which Fits Your Practice?
HIPAA Consulting is way less rigid than HIPAA compliance software. compare for yourself online. This article is one that's written by a consultant who is also offering a software solution because he's seen what happens when software alone is not enough.
6 min read
HIPAA Security Rule Delayed to 2027: What Changed and What to Do Now
HHS pushed the Security Rule overhaul to July 2027, but the Privacy Rule changes for substance use disorder records are already enforceable. Here is what your practice needs to do right now.
6 min read
No Risk Assessment, No HIPAA Policies: What Small Clinics Risk
A small clinic with no Security Risk Assessment and no written HIPAA policies is operating with zero defensible compliance. Here is what that actually means when OCR comes knocking.
7 min read
Does Your Small Clinic Need a HIPAA Risk Assessment? What Happens After the Gaps Are Found
Small clinic without a HIPAA risk assessment? Here is why you need one and exactly what happens after compliance gaps are found.
Key HIPAA terms used in these articles
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
- Protected Health Information (PHI)
- Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium (45 CFR 160.103).
- Electronic PHI (ePHI)
- PHI that is created, received, maintained, or transmitted in electronic form (45 CFR 160.103).
- Covered Entity
- A health plan, health care clearinghouse, or health care provider that transmits health information electronically (45 CFR 160.103).
- Business Associate
- A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors (45 CFR 160.103).
- Business Associate Agreement (BAA)
- The written contract HIPAA requires between a covered entity and a business associate (45 CFR 164.502(e), 164.504(e)).
- Security Rule
- The standards for protecting ePHI through administrative, physical, and technical safeguards (45 CFR Part 164, Subpart C).
- Security Risk Assessment (SRA)
- The accurate and thorough risk analysis the Security Rule requires you to conduct and document (45 CFR 164.308(a)(1)(ii)(A)).
- Breach Notification Rule
- After a breach of unsecured PHI, individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery, and HHS must be notified (45 CFR 164.400 to 164.414).
More HIPAA resources
- Acadia healthcare breach lessons
- Compliancy Group gap analysis comparison
- Healthcare cybersecurity framework
- HIPAA telehealth compliance
- Why HIPAA risk assessment comes first
- HIPAA social media compliance
- HIPAA texting patient rules
- Is Dropbox HIPAA compliant?
- Is faxing HIPAA compliant?
- Is Gmail HIPAA compliant?
- Is Google Drive HIPAA compliant?
- Is iCloud HIPAA compliant?
- Is Microsoft Teams HIPAA compliant?
- Is Slack HIPAA compliant?
- Is Zoom HIPAA compliant?
- Healthcare ransomware protection
- HIPAA termination procedures
- UMMC ransomware lessons
- PHI in AI prompts
- HIPAA audit readiness FAQ
- HIPAA BAA FAQ
- HIPAA consulting cost for small practices
- HIPAA FAQ for small practices
- HIPAA policy templates for small practices