Healthcare & HIPAA

The proposed Security Rule update has slipped, and anyone telling you it is imminent is selling something. What the current position is and what to do meanwhile.

What an Office for Civil Rights letter usually means, what it will ask for, and the first things to do in the days after it arrives.

There is no such thing as a HIPAA certified IT company. Here is what to ask instead, and which answers should worry you.

What to sort out before, during and after an EHR migration so that the move does not leave protected health information somewhere you have forgotten.

A signed BAA is the start, not the finish. What the agreement should say, what it cannot do for you, and the vendors practices forget to cover.

HIPAA expects you to record and review system activity. What that means in a practice that does not have a security team, and why it matters after an incident.

A dual track playbook for the days after a suspected breach at an Arizona practice, covering both HIPAA and state obligations without missing either clock.

Arizona requires notification within 45 days, tighter than HIPAA’s 60. What the state law says, when the Attorney General gets involved, and how it interacts with federal rules.

A practical sequence for running a HIPAA security risk analysis in a small or mid sized practice, from inventory to remediation plan.

Why the risk analysis is the requirement that shows up in nearly every OCR settlement, what it actually has to contain, and how to tell if yours counts.