In-depth HIPAA compliance articles covering Business Associate Agreements, security risk assessments, workforce training requirements, and enforcement trends from the HHS Office for Civil Rights.
HIPAA compliance involves dozens of recurring tasks: annual risk assessments, policy reviews, workforce training, vendor agreement tracking, and incident documentation. For small and mid-size healthca...
11 min read
HIPAA only applies if you are a covered entity. Here's how 45 CFR 160.103 defines one, who qualifies, and what OCR does when organizations get it wrong.
14 min read
Your NPP is the single document every patient receives. Get it wrong and OCR has a case before a breach even occurs.
11 min read
In May 2024, a cyberattack on Okanogan Behavioral HealthCare exposed the names, Social Security numbers, medical records, and diagnoses of nearly 1,100 patients. A class action settlement is now open. Here is what we know.
19 min read
A plain-English guide to all three HIPAA safeguard categories, administrative, physical, and technical, with CFR citations, real-world examples, and practical implementation steps for covered entities and business associates.
15 min read
PHI, PII, and ePHI are not interchangeable terms. Each has a different legal definition, different regulatory scope, and different compliance obligations. This guide breaks down exactly what each term means, where they overlap, and what your organization needs to do about each one.
17 min read
Learn what electronic Protected Health Information (ePHI) is, see real-world examples, and understand the HIPAA Security Rule requirements that govern how covered entities and business associates must protect it.
11 min read
A HIPAA business associate agreement is a legally required contract before any vendor touches PHI. Here is what it must contain, who needs one, and what happens without one.
5 min read
The COVID grace period is over. Telehealth now faces full HIPAA review. Learn what platforms you can use, how to protect patient data, and what changed in 2026.