16 min read
Change Healthcare Breach: One Year Later
192.7 million people affected. $3.09 billion in costs. One year after the largest healthcare breach in US history, here's what changed, and what didn't.
Archive
HIPAA Compliance Articles: Page 18
Continue exploring our HIPAA compliance library with expert articles on Security Rule implementation, risk assessments, and healthcare cybersecurity. One Guy Consulting publishes in-depth guides, compliance checklists, and practical advice for covered entities and business associates navigating HIPAA requirements.
16 min read
12 min read
Healthcare Breaches in 2025: What the Data Shows and What to Do
At least 710 large healthcare breaches were reported in 2025. Attackers keep hitting smaller targets and vendors. Here is what the data says and how to protect your practice.
20 min read
2025 HIPAA Fines: Who Got Caught and Why
HHS lists 24 HIPAA enforcement actions dated 2025. A missing risk analysis showed up again and again. Here's who paid and how to avoid the same mistakes.
11 min read
HIPAA Fines Increased: 2026 Penalty Amounts
HHS raised HIPAA penalty amounts about 2.6% on January 28, 2026. See the exact new fines by tier, what triggers each level, and how to stay out of the top tiers.
17 min read
HIPAA and MFA in 2026: A Plain-English Guide
MFA is in the proposed HIPAA Security Rule update. What it costs, which app to pick, and why to roll it out at your practice this week.
17 min read
Proposed HIPAA Security Rule: 7 Key Changes
The biggest proposed HIPAA Security Rule update since 2013: MFA, encryption, and yearly compliance audits. Here is what would change if it becomes final, and when.
13 min read
UMMC Ransomware Attack: Healthcare Lessons
The Feb 2026 UMMC ransomware attack closed all 35 clinics and canceled elective procedures across Mississippi. Here is what every healthcare practice needs to learn.
17 min read
Cloudflare Outage Feb 2026: HIPAA Lessons for Healthcare
A single API bug in Cloudflare's Feb 2026 outage took about 1,100 customer IP prefixes offline, some for over 6 hours. Here's what happened and which HIPAA contingency planning duties it tests. We also cover how healthcare organizations can build the backup and recovery procedures that 45 CFR §164.308(a)(7) calls for.
14 min read
HIPAA Compliance Checklist for Small Practices
Most compliance vendors quote $10K+. Here is what OCR actually requires from small practices, and how to get compliant without breaking the bank.
Key terms
Key HIPAA terms used in these articles
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
- Protected Health Information (PHI)
- Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium. 45 CFR 160.103
- Electronic PHI (ePHI)
- PHI that is created, received, maintained, or transmitted in electronic form. 45 CFR 160.103
- Covered Entity
- A health plan, health care clearinghouse, or health care provider that transmits health information electronically. 45 CFR 160.103
- Business Associate
- A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors. 45 CFR 160.103
- Business Associate Agreement (BAA)
- The written contract HIPAA requires between a covered entity and a business associate. 45 CFR 164.502(e), 164.504(e)
- Security Rule
- The standards for protecting ePHI through administrative, physical, and technical safeguards. 45 CFR Part 164, Subpart C
- Security Risk Assessment (SRA)
- The accurate and thorough risk analysis the Security Rule requires you to conduct and document. 45 CFR 164.308(a)(1)(ii)(A)
- Breach Notification Rule
- After a breach of unsecured PHI, individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery, and HHS must be notified. 45 CFR 164.400 to 164.414