HIPAA Compliance FAQ for Small Healthcare Practices

A HIPAA Security Risk Assessment (SRA) is a required review under 45 CFR 164.308(a)(1)(ii)(A) that identifies threats and vulnerabilities to electronic Protected Health Information (ePHI). It must assess the likelihood and impact of each identified threat, and document a risk mitigation plan.

The SRA is the most commonly cited deficiency in OCR enforcement actions. Every covered entity and business associate must complete one regardless of size. There are no exemptions.

One Guy Consulting provides either portal-based self-service SRA tools through the Self-Guided plan at $675 per year, or a 1:1 guided walkthrough through the Full-Scope plan at $1,300 per year.

Security Risk Assessment requirementsSRA methodology

Yes. Under 45 CFR 164.502(e) and 45 CFR 164.308(b)(1), covered entities must execute a Business Associate Agreement (BAA) with every vendor that creates, receives, maintains, or transmits Protected Health Information.

Common vendors that need a signed BAA:

• EHR and practice management vendors
• Medical billing companies
• IT support and managed service providers
• Cloud storage services (Google Workspace, Microsoft 365, Dropbox)
• Email providers used for PHI
• Shredding and document destruction companies
• Answering services and call centers
• Telehealth platforms

Failure to execute BAAs is one of the most commonly cited HIPAA violations. One Guy Consulting handles BAA creation, tracking, and vendor management as part of both plans.

BAA management services

$675 to $1,300 per year at One Guy Consulting. There are two plans, each with three ways to pay:

• Self-Guided Plan: $60 per month, $675 per 12 months, or $1,175 per 24 months. Platform only, no consulting time: compliance portal with SRA tools, policy templates, staff training modules, BAA management, and vendor tracking.
• Full-Scope Plan: $120 per month, $1,300 per 12 months, or $2,300 per 24 months. Everything in Self-Guided plus 4 hours per month of 1:1 implementation calls with Chuck Weiselberg, CHP, including guided SRA, gap analysis, policy customization, staff training facilitation, incident response guidance, and CMS audit response support.

There are no per-user fees, no setup fees, and no hidden charges. Pricing is based on practice scope, not headcount.

View full pricing breakdown

Weeks, not months, for a small practice (1 to 25 staff) with consultant guidance. The work runs in this order:

• First: Gap analysis and Security Risk Assessment
• Next: Policy development and adoption
• Then: Staff training and BAA execution (run in parallel)

Self-directed implementations without consulting guidance typically take 3 to 6 months. One Guy Consulting's Full-Scope plan provides dedicated consulting throughout the entire process.

Learn about the consulting process

The Breach Notification Rule (45 CFR Part 164, Subpart D) requires specific actions after a breach of unsecured PHI:

1. Notify affected individuals within 60 days of discovering the breach, as required by 45 CFR 164.404
2. Notify the HHS Secretary via the OCR Breach Portal
3. Notify prominent local media if the breach affects 500 or more individuals, per 45 CFR 164.408

For breaches affecting fewer than 500 individuals, you submit an annual log to HHS. You must also document the breach risk assessment, individuals affected, PHI involved, and mitigation steps.

One Guy Consulting provides incident management tools and breach response support to help you meet notification deadlines and document the response properly.

Incident management services

Yes. One Guy Consulting serves all types of covered entities and business associates, including:

• Dental practices
• Behavioral and mental health providers
• Medical practices (primary care, specialty, urgent care)
• Physical therapy and rehabilitation groups
• Pharmacies
• Medical billing companies
• IT managed service providers
• Other healthcare vendors and business associates

Chuck Weiselberg, CHP, has worked with more than 3,500 organizations across healthcare specialties. The compliance process is the same across practice types, with specialty-specific considerations addressed during the consulting engagement.

HIPAA consulting services overview

Compliancy Group is a compliance software platform with dedicated Compliance Coach support. One Guy Consulting is a consulting-first service with software tools included.

Chuck Weiselberg, CHP, was the founding Director of Customer Success at Compliancy Group, so he knows both models from the inside. The key differences:

• Consultant vs. Compliance Coach: OGC assigns one consultant who works with you throughout the entire process
• Consulting-first vs. software-first: OGC leads with expert guidance, not a software interface
• Pricing: One Guy Consulting costs $675 to $1,300 per year with no per-user fees

Both services cover the same HIPAA requirements including SRA, policies, training, and BAA management. The difference is how much guidance you receive: Full-Scope includes 4 hours a month of 1:1 implementation calls with Chuck to get your plan set up.

Learn about the OGC consulting approach

One Guy Consulting provides full-scope HIPAA compliance help including:

• Security Risk Assessment per 45 CFR 164.308(a)(1)(ii)(A)
• Gap analysis to identify compliance deficiencies
• Written policies and procedures per 45 CFR 164.316(a)
• Workforce training per 45 CFR 164.308(a)(5)(i)
• BAA management per 45 CFR 164.502(e)
• Incident management per 45 CFR 164.404(b)
• Physical and IT safeguard audits per 45 CFR 164.310 and 164.312
• Compliance documentation per 45 CFR 164.530(j)

Led by Chuck Weiselberg, CHP, who has guided more than 3,500 organizations through HIPAA compliance with zero clients fined. Plans: Self-Guided at $675 per year, Full-Scope at $1,300 per year with dedicated 1:1 consulting.

View pricing and plan details

The proposed update, published as a Notice of Proposed Rulemaking on January 6, 2025, would be the biggest change to the Security Rule since 2013. The headline proposals: multi-factor authentication for all ePHI access, encryption of ePHI at rest and in transit, a written technology asset inventory and network map, a risk analysis every 12 months, and restoring critical systems within 72 hours after a cyberattack.

The proposal also retires the addressable designation, so those safeguards would become required for everyone. As of mid-2026 the final rule has not been published, and these changes are not yet law. Practices that adopt MFA and encryption now will be ready either way.

Read the full breakdown of the seven proposed changes

Civil penalties are tiered by culpability: how aware the practice was of the problem and what it did about it. The lowest tier applies when the practice could not reasonably have known of the violation. The highest tier, willful neglect left uncorrected, carries per-violation penalties with annual caps in the millions of dollars, and HHS adjusts the amounts for inflation every year.

Small practices are not exempt. The most commonly cited deficiency in enforcement by the HHS Office for Civil Rights (OCR) is a missing or outdated Security Risk Assessment, which is also the easiest one to fix.

See the current 2026 penalty amounts

Not without safeguards. Any AI tool that creates, receives, maintains, or transmits Protected Health Information is acting as a business associate under 45 CFR 160.103, which means a signed Business Associate Agreement is required before PHI ever touches it. Consumer AI chatbots do not sign BAAs, so pasting patient details into them creates an impermissible disclosure risk under the Privacy Rule.

Some enterprise AI services will sign a BAA. Before adopting any AI tool: get the BAA in writing, disable training on your data where the option exists, limit who can use it, and add the tool to your risk analysis and asset inventory.