19 min read
Healthcare Data Breach Prevention: Complete Strategy
How to prevent healthcare data breaches. Covers common threats, technical defenses, admin safeguards, and what to do if a breach happens.
HIPAA Compliance Articles: Page 13
Articles covering state privacy law interactions, enforcement case studies, corrective action plans, and the foundational elements of a HIPAA compliance program. These resources help organizations understand how federal HIPAA requirements intersect with state-level privacy and security regulations.
19 min read
28 min read
HIPAA Breach Notification Rule Compliance Guide
What the HIPAA Breach Notice Rule requires. Covers who to notify, the 60-day deadline, risk review, records, and state rules.
12 min read
How to Respond to a HIPAA Data Breach
What to do after a HIPAA data breach. Step-by-step plan covering containment, review, notices, records, and follow-up security fixes.
19 min read
HIPAA Training: Implementation Guide
How to build a HIPAA training program that works. Training by role, ways to deliver it, how to track it, and what to keep on file.
10 min read
Cloud Storage Compliance for Healthcare Data
Cloud storage and HIPAA can work together. Who owes what, BAAs, encryption, and how AWS, Azure, and Google Cloud fit in.
14 min read
Mobile Device Security in Healthcare Settings
How to lock down phones and tablets in a practice. BYOD rules, device management, encryption, remote wipe, and safe Wi-Fi.
10 min read
Access Control Best Practices for ePHI
How to control who can reach ePHI. Access by role, MFA, auto log-off, audit logs, and giving out only what is needed.
18 min read
Physical Safeguards: HIPAA Security Rule Requirements
HIPAA physical safeguards, explained. Who gets in the door, how a workstation is kept safe, device controls, and what guards the building.
25 min read
What Is a HIPAA Officer? Role, Requirements & Duties
What a HIPAA compliance officer does day to day. Covers duties, skills, daily tasks, and tips for doing the job well.
Key HIPAA terms used in these articles
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
- Protected Health Information (PHI)
- Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium (45 CFR 160.103).
- Electronic PHI (ePHI)
- PHI that is created, received, maintained, or transmitted in electronic form (45 CFR 160.103).
- Covered Entity
- A health plan, health care clearinghouse, or health care provider that transmits health information electronically (45 CFR 160.103).
- Business Associate
- A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors (45 CFR 160.103).
- Business Associate Agreement (BAA)
- The written contract HIPAA requires between a covered entity and a business associate (45 CFR 164.502(e), 164.504(e)).
- Security Rule
- The standards for protecting ePHI through administrative, physical, and technical safeguards (45 CFR Part 164, Subpart C).
- Security Risk Assessment (SRA)
- The accurate and thorough risk analysis the Security Rule requires you to conduct and document (45 CFR 164.308(a)(1)(ii)(A)).
- Breach Notification Rule
- After a breach of unsecured PHI, individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery, and HHS must be notified (45 CFR 164.400 to 164.414).