12 min read
Drata vs One Guy Consulting (2026)
Drata is a leading compliance automation platform. Considering their services? See how One Guy Consulting compares for small healthcare practices.
Archive
HIPAA Compliance Articles: Page 17
Continue exploring our HIPAA compliance library with expert articles on Security Rule implementation, risk assessments, and healthcare cybersecurity. One Guy Consulting publishes in-depth guides, compliance checklists, and practical advice for covered entities and business associates navigating HIPAA requirements.
12 min read
9 min read
Paubox vs One Guy Consulting (2026)
Paubox offers email encryption for healthcare. See how One Guy Consulting compares for small healthcare practices.
14 min read
Accountable vs One Guy Consulting (2026)
Accountable is an accessible HIPAA compliance platform. Considering their services? See how One Guy Consulting compares for small healthcare practices.
19 min read
Compliancy Group vs One Guy Consulting (2026)
Compliancy Group is a popular HIPAA compliance platform for small healthcare organizations. See how it compares to One Guy Consulting on speed, cost, automation, and regulatory coverage " including 2026 Security Rule updates.
25 min read
Best HIPAA Compliance Software for Small Practices
The 5 essential HIPAA compliance tools every provider needs, from risk assessments to audit logging, and how to choose the right ones.
16 min read
HIPAA Gap Analysis Guide for Healthcare Teams
What a HIPAA gap analysis covers, when you need one, and how to perform a step-by-step compliance assessment for your organization.
12 min read
One Guy Consulting Compliance Blog | KadNap Botnet
KadNap hijacks ASUS routers and sells them to criminals as proxies. Here is what small healthcare practices should know, and how to check and clean up an office router.
17 min read
HIPAA Encryption Requirements: Does HIPAA Require Encryption?
HIPAA encryption is addressable, but that does not mean optional. Here is what OCR expects for stored data, sent data and email. We also cover what the proposed update would change.
9 min read
SUD Clinic Pays OCR $103K: Why 42 CFR Part 2 Matters
An Illinois addiction treatment center paid OCR $103K. After a phishing breach, OCR found it had not done an accurate and thorough risk analysis. Here's what Part 2 enforcement means for your practice.
Key terms
Key HIPAA terms used in these articles
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
- Protected Health Information (PHI)
- Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium. 45 CFR 160.103
- Electronic PHI (ePHI)
- PHI that is created, received, maintained, or transmitted in electronic form. 45 CFR 160.103
- Covered Entity
- A health plan, health care clearinghouse, or health care provider that transmits health information electronically. 45 CFR 160.103
- Business Associate
- A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors. 45 CFR 160.103
- Business Associate Agreement (BAA)
- The written contract HIPAA requires between a covered entity and a business associate. 45 CFR 164.502(e), 164.504(e)
- Security Rule
- The standards for protecting ePHI through administrative, physical, and technical safeguards. 45 CFR Part 164, Subpart C
- Security Risk Assessment (SRA)
- The accurate and thorough risk analysis the Security Rule requires you to conduct and document. 45 CFR 164.308(a)(1)(ii)(A)
- Breach Notification Rule
- After a breach of unsecured PHI, individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery, and HHS must be notified. 45 CFR 164.400 to 164.414