10 min read
Why 'Addressable' Doesn't Mean 'Optional' in HIPAA
Many practices skip "addressable" HIPAA rules thinking they are optional. They are not, and the new Security Rule drops the label.
HIPAA Compliance Articles: Page 11
Guidance on HIPAA authorization forms, minimum necessary rules, de-identification standards, and patient rights under the Privacy Rule. Knowing these Privacy Rule basics is key for any practice that collects, stores, or sends protected health information.
10 min read
14 min read
7 Business Associate Agreement Mistakes to Avoid
The 7 BAA mistakes that get practices fined, with real OCR cases and what the new Security Rule means for your vendor deals.
15 min read
Illinois HIPAA Compliance & Requirements Guide
Illinois HIPAA compliance guide with clear, hands-on steps for healthcare teams.
11 min read
Florida HIPAA Laws & Compliance Requirements
Florida HIPAA compliance guide with state-level details for healthcare teams.
13 min read
Texas HIPAA Laws & Compliance Requirements
Texas HIPAA compliance guide with state rules and hands-on controls.
17 min read
California HIPAA & CMIA Compliance Guide
California HIPAA compliance guide with CMIA, CCPA health data rules, patient access, breach notice, and a hands-on checklist.
14 min read
Ransomware Hit Your Practice: First 72 Hours
Hour-by-hour ransomware response plan for healthcare. Covers containment, reporting, and recovery to protect your practice and patients.
16 min read
HIPAA Compliance Requirements in New York
New York HIPAA compliance guide with state privacy and cyber safety rules.
13 min read
How Long Does HIPAA Compliance Take?
Real-world HIPAA compliance timelines by team size, plus a step-by-step rollout plan.
Key HIPAA terms used in these articles
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
- Protected Health Information (PHI)
- Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium (45 CFR 160.103).
- Electronic PHI (ePHI)
- PHI that is created, received, maintained, or transmitted in electronic form (45 CFR 160.103).
- Covered Entity
- A health plan, health care clearinghouse, or health care provider that transmits health information electronically (45 CFR 160.103).
- Business Associate
- A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors (45 CFR 160.103).
- Business Associate Agreement (BAA)
- The written contract HIPAA requires between a covered entity and a business associate (45 CFR 164.502(e), 164.504(e)).
- Security Rule
- The standards for protecting ePHI through administrative, physical, and technical safeguards (45 CFR Part 164, Subpart C).
- Security Risk Assessment (SRA)
- The accurate and thorough risk analysis the Security Rule requires you to conduct and document (45 CFR 164.308(a)(1)(ii)(A)).
- Breach Notification Rule
- After a breach of unsecured PHI, individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery, and HHS must be notified (45 CFR 164.400 to 164.414).