11 min read
Healthcare Breaches Doubled in 2025: What to Do
642 healthcare breaches hit in 2025 and attackers are targeting smaller practices. What the data says and how to protect yourself.
HIPAA Compliance Articles: Page 10
HIPAA resources on data backup procedures, facility access controls, device and media controls, and staff security awareness training requirements. These articles help organizations build the operational policies and procedures that auditors and regulators expect to see documented.
11 min read
17 min read
$6.6M in HIPAA Fines in 2025: Who Got Caught
OCR handed out 20 enforcement actions totaling $6.6M in 2025. Risk analysis failures dominated. Here's who paid and how to avoid the same mistakes.
10 min read
HIPAA Fines Increased: 2026 Penalty Amounts
HHS raised HIPAA penalty amounts 2.6% for 2026. See the exact new fines by tier, what triggers each level, and how to stay in the lowest bracket.
15 min read
HIPAA MFA Requirement 2026: A Plain-English Guide
MFA is now mandatory under HIPAA. Here is what it costs, which app to pick, and how to roll it out at your practice this week.
16 min read
HIPAA Security Rule 2026: 7 Key Changes
The biggest HIPAA Security Rule update since 2013 mandates MFA, encryption, and annual audits. Here is what changes and when you must comply.
12 min read
UMMC Ransomware Attack: Healthcare Lessons
The Feb 2026 UMMC ransomware attack shut down 35 clinics and canceled surgeries across Mississippi. Here is what every healthcare practice needs to learn.
16 min read
Cloudflare Outage Feb 2026: HIPAA Lessons for Healthcare
Cloudflare's Feb 2026 outage took 1,100 networks offline for 6+ hours via a single API bug. Here's what happened, the HIPAA contingency planning obligations it triggered, and how healthcare organizations can build the redundancy and recovery procedures required under 45 CFR §164.308(a)(7).
12 min read
HIPAA Compliance Starter Kit for Small Practices
Most compliance vendors quote $10K+. Here is what OCR actually requires from small practices — and how to get compliant without breaking the bank.
13 min read
Vendor Got Hacked? Step-by-Step Response Plan
When a business associate breach hits, the clock starts. Here is your 12-step vendor breach response plan to protect patients and avoid HIPAA fines.
Key HIPAA terms used in these articles
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
- Protected Health Information (PHI)
- Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium (45 CFR 160.103).
- Electronic PHI (ePHI)
- PHI that is created, received, maintained, or transmitted in electronic form (45 CFR 160.103).
- Covered Entity
- A health plan, health care clearinghouse, or health care provider that transmits health information electronically (45 CFR 160.103).
- Business Associate
- A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors (45 CFR 160.103).
- Business Associate Agreement (BAA)
- The written contract HIPAA requires between a covered entity and a business associate (45 CFR 164.502(e), 164.504(e)).
- Security Rule
- The standards for protecting ePHI through administrative, physical, and technical safeguards (45 CFR Part 164, Subpart C).
- Security Risk Assessment (SRA)
- The accurate and thorough risk analysis the Security Rule requires you to conduct and document (45 CFR 164.308(a)(1)(ii)(A)).
- Breach Notification Rule
- After a breach of unsecured PHI, individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery, and HHS must be notified (45 CFR 164.400 to 164.414).