15 min read
Change Healthcare Breach: One Year Later
192.7 million people affected. $3.09 billion in costs. One year after the largest healthcare breach in history, here's what changed — and what didn't.
HIPAA Compliance Articles: Page 17
Continue exploring our HIPAA compliance library with expert articles on Security Rule implementation, risk assessments, and healthcare cybersecurity. One Guy Consulting publishes in-depth guides, compliance checklists, and practical advice for covered entities and business associates navigating HIPAA requirements.
15 min read
11 min read
Healthcare Breaches Doubled in 2025: What to Do
642 healthcare breaches hit in 2025 and attackers are targeting smaller practices. What the data says and how to protect yourself.
17 min read
$6.6M in HIPAA Fines in 2025: Who Got Caught
OCR handed out 20 enforcement actions totaling $6.6M in 2025. Risk analysis failures dominated. Here's who paid and how to avoid the same mistakes.
10 min read
HIPAA Fines Increased: 2026 Penalty Amounts
HHS raised HIPAA penalty amounts 2.6% for 2026. See the exact new fines by tier, what triggers each level, and how to stay in the lowest bracket.
15 min read
HIPAA MFA Requirement 2026: A Plain-English Guide
MFA is in the proposed HIPAA Security Rule update. What it costs, which app to pick, and why to roll it out at your practice this week.
16 min read
HIPAA Security Rule 2026: 7 Key Changes
The biggest proposed HIPAA Security Rule update since 2013: MFA, encryption, and annual audits. What changes if it is finalized, and when.
12 min read
UMMC Ransomware Attack: Healthcare Lessons
The Feb 2026 UMMC ransomware attack shut down 35 clinics and canceled surgeries across Mississippi. Here is what every healthcare practice needs to learn.
16 min read
Cloudflare Outage Feb 2026: HIPAA Lessons for Healthcare
Cloudflare's Feb 2026 outage took 1,100 networks offline for 6+ hours via a single API bug. Here's what happened, the HIPAA contingency planning obligations it triggered, and how healthcare organizations can build the redundancy and recovery procedures required under 45 CFR §164.308(a)(7).
14 min read
HIPAA Compliance Starter Kit for Small Practices
Most compliance vendors quote $10K+. Here is what OCR actually requires from small practices — and how to get compliant without breaking the bank.
Key HIPAA terms used in these articles
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
- Protected Health Information (PHI)
- Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium (45 CFR 160.103).
- Electronic PHI (ePHI)
- PHI that is created, received, maintained, or transmitted in electronic form (45 CFR 160.103).
- Covered Entity
- A health plan, health care clearinghouse, or health care provider that transmits health information electronically (45 CFR 160.103).
- Business Associate
- A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors (45 CFR 160.103).
- Business Associate Agreement (BAA)
- The written contract HIPAA requires between a covered entity and a business associate (45 CFR 164.502(e), 164.504(e)).
- Security Rule
- The standards for protecting ePHI through administrative, physical, and technical safeguards (45 CFR Part 164, Subpart C).
- Security Risk Assessment (SRA)
- The accurate and thorough risk analysis the Security Rule requires you to conduct and document (45 CFR 164.308(a)(1)(ii)(A)).
- Breach Notification Rule
- After a breach of unsecured PHI, individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery, and HHS must be notified (45 CFR 164.400 to 164.414).