10 min read
HIPAA Gap Analysis: Process, Findings & Remediation
A gap analysis identifies HIPAA weaknesses. Learn what comes next " remediation planning, timelines, ownership, and how to close gaps before an audit.
HIPAA Compliance Articles: Page 6
Healthcare compliance insights covering cybersecurity best practices, ePHI protection strategies, access controls, and audit preparation for HIPAA-regulated organizations. These articles reflect current OCR enforcement priorities and real compliance gaps identified across hundreds of assessments.
10 min read
15 min read
HIPAA Compliance Cost for Small Practices (2026 Pricing)
HIPAA consulting costs for small healthcare offices range from one-time projects to ongoing support. See what drives pricing and what you get for it.
10 min read
Do Vendors and MSPs Need a BAA for Every PHI-Touching Vendor?
Not every vendor needs a BAA, but every PHI-touching one does. Learn when BAAs are required, how to manage them, and what proof to keep for audits.
7 min read
What Proof Do Auditors Expect for HIPAA Compliance?
Auditors want documented proof of HIPAA compliance, not verbal assurances. See the exact documents, logs, and records needed to pass an audit.
3 min read
Healthcare Data Breach Trends: What the Numbers Tell Us
What HappenedAccording to a report by The HIPAA Journal, healthcare data breaches have become a critical issue. The report highlights recent trends in breaches, emphasizing an increase in incidents ov...
4 min read
Acadia Healthcare Breach Exposes Data
What HappenedRecently, Acadia Healthcare experienced a data breach. This incident exposed the Social Security numbers of numerous individuals. The breach has raised significant concerns about data sec...
8 min read
HIPAA Termination Procedures
Former employees retaining system access is one of the most common HIPAA audit findings. Learn how to build a termination checklist that protects your practice.
19 min read
How the Telnyx Supply Chain Attack Exposes HIPAA Compliance Gaps
On March 27, 2026, threat group TeamPCP compromised the Telnyx Python SDK on PyPI in a three-stage supply chain attack. This article examines the HIPAA compliance gaps the attack exposed and what healthcare organizations must do to assess risk, manage vendor relationships, and meet breach notification obligations.
13 min read
PHI 18 Identifiers: What Counts as Protected Health Information
HIPAA defines 18 specific identifiers that make health information protected. Most healthcare staff do not know what they are. Here is why that matters when your team uses AI tools.
Key HIPAA terms used in these articles
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
- Protected Health Information (PHI)
- Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium (45 CFR 160.103).
- Electronic PHI (ePHI)
- PHI that is created, received, maintained, or transmitted in electronic form (45 CFR 160.103).
- Covered Entity
- A health plan, health care clearinghouse, or health care provider that transmits health information electronically (45 CFR 160.103).
- Business Associate
- A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors (45 CFR 160.103).
- Business Associate Agreement (BAA)
- The written contract HIPAA requires between a covered entity and a business associate (45 CFR 164.502(e), 164.504(e)).
- Security Rule
- The standards for protecting ePHI through administrative, physical, and technical safeguards (45 CFR Part 164, Subpart C).
- Security Risk Assessment (SRA)
- The accurate and thorough risk analysis the Security Rule requires you to conduct and document (45 CFR 164.308(a)(1)(ii)(A)).
- Breach Notification Rule
- After a breach of unsecured PHI, individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery, and HHS must be notified (45 CFR 164.400 to 164.414).