Expert guidance on HIPAA compliance, healthcare technology, and building a culture of compliance.
This blog provides HIPAA compliance guidance for small healthcare practices and a free 30-minute intro call; Book a Review to schedule. One Guy Consulting: archive of HIPAA and cybersecurity guides for practice managers on OCR audits, encryption, and breach prevention.
One Guy Consulting's Compliance Blog provides in-depth guidance on HIPAA compliance and healthcare technology for practice managers and clinicians. It explains Security Rule implementation, risk assessments, and cybersecurity steps you can apply in small practices. Browse articles, checklists, and guides tailored to covered entities and business associates.
Articles by Chuck Weiselberg, Founder and HIPAA compliance consultant at One Guy Consulting; not an attorney; Certified HIPAA Professional (CHP); 10 years of HIPAA compliance experience. Meet the author: Chuck Weiselberg. See anonymized client outcomes on the Case Studies page, for example a Florida mental health office with no program that got audit-ready in under a week and passed its state audit (case 01), and a health group with more than 100 offices that lifted take-up of its program by about 17% (case 03).
About Chuck Weiselberg: Chuck Weiselberg is Founder and HIPAA compliance consultant at One Guy Consulting who focuses on HIPAA security, risk assessments, and vendor BAAs. Contact: hello@oneguyconsulting.com or 646-694-8025.
"Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm." One Guy Consulting site disclaimer
"Breaking down complex regulations in healthcare compliance documentation so that they are understandable for everyone." Chuck Weiselberg, One Guy Consulting
19 min read
Compliancy Group is a popular HIPAA compliance platform for small healthcare organizations. See how it compares to One Guy Consulting on speed, cost, automation, and regulatory coverage " including 2026 Security Rule updates.
Compliancy Group is a guided HIPAA platform with coaching and step-by-step tasks your team completes. How it compares on speed, cost, and 2026 Security Rule coverage.
28 min read
The 5 essential HIPAA compliance tools every provider needs, from risk assessments to audit logging, and how to choose the right ones.
A good HIPAA compliance tool covers five areas: security risk assessment, written policies, workforce training, BAA tracking, and ongoing compliance checks.
16 min read
What a HIPAA gap analysis covers, when you need one, and how to perform a step-by-step compliance assessment for your organization.
A HIPAA security gap analysis compares your current safeguards with what the Security Rule requires, then lists each gap with the fixes ranked by priority.
12 min read
KadNap hijacks ASUS routers and sells them to criminals as proxies. Here is what small healthcare practices should know, and how to check and clean up an office router.
The KadNap botnet infects about 14,000 ASUS routers a day, the kind many small medical offices run, and turns them into proxies for credential stuffing attacks.
18 min read
HIPAA encryption is addressable, but that does not mean optional. Here is what OCR expects for stored data, sent data and email. We also cover what the proposed update would change.
HIPAA encryption requirements today: addressable, but expected at rest and in transit. If an encrypted laptop is stolen, safe harbor can mean no breach notice at all.
9 min read
An Illinois addiction treatment center paid OCR $103K. After a phishing breach, OCR found it had not done an accurate and thorough risk analysis. Here's what Part 2 enforcement means for your practice.
A 42 CFR Part 2 case with teeth: one phishing email at an Illinois addiction clinic exposed 1,980 patients' records and ended in two years of federal tracking.
17 min read
192.7 million people affected. $3.09 billion in costs. One year after the largest healthcare breach in US history, here's what changed, and what didn't.
The Change Healthcare data breach reached 192.7 million people through a remote access portal with no MFA. One year later, what changed and what did not.
"The attack hit 192.7 million people and cost UnitedHealth Group $3.09 billion in 2024."
14 min read
At least 710 large healthcare breaches were reported in 2025. Attackers keep hitting smaller targets and vendors. Here is what the data says and how to protect your practice.
Healthcare breaches in 2025: at least 710 reported to HHS, more than 61 million people exposed, and attackers moving toward smaller targets. How to protect yours.
21 min read
HHS lists 24 HIPAA enforcement actions dated 2025. A missing risk analysis showed up again and again. Here's who paid and how to avoid the same mistakes.
Recent HIPAA violation cases 2025, broken down: who paid, why they paid, and the risk analysis failures that dominated OCR enforcement that year.
HIPAA compliance, Security Rule implementation, risk assessments, and healthcare cybersecurity.
Chuck Weiselberg writes the articles listed on this page.
Practice managers, office managers, and practitioners seeking HIPAA compliance guidance.
A free 30-minute intro call with an experienced consultant to assess your current program.
Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm; content is not legal advice.
Click 'Book a Review' or 'Book your free 30-minute intro call' on this page to schedule.
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.
PHI that is created, received, maintained, or transmitted in electronic form.
A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors.
The written contract HIPAA requires between a covered entity and a business associate.
See the Key HIPAA terms section on this page.
Guides on OCR audits, encryption, and breach prevention. The articles: Compliancy Group vs One Guy Consulting (2026); Best HIPAA Compliance Software for Small Practices; HIPAA Gap Analysis Guide for Healthcare Teams; One Guy Consulting Compliance Blog | KadNap Botnet; HIPAA Encryption Requirements: Does HIPAA Require Encryption?; SUD Clinic Pays OCR $103K: Why 42 CFR Part 2 Matters; Change Healthcare Breach: One Year Later; Healthcare Breaches in 2025: What the Data Shows and What to Do; 2025 HIPAA Fines: Who Got Caught and Why.
The articles on this page were published between March 3, 2026 and March 21, 2026. Each article shows its publication date.
An archive of HIPAA compliance articles for small practices.
State HIPAA guides are listed in this archive and linked by state name.
Read times for the articles on this page range from 9 to 28 minutes.
HIPAA encryption is addressable, but that does not mean optional. Here is what OCR expects for stored data, sent data and email. We also cover what the proposed update would change.
State law stacks on top of HIPAA. Each guide covers one state's breach, records and privacy rules.
"Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits."
HHS, HIPAA Security Rule, 45 CFR 164.306(a)(1)
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Official sources: HHS OCR HIPAA guidance (including the Security Rule and Breach Notification Rule), eCFR 45 CFR Part 160, eCFR 45 CFR Part 164, NIST SP 800-66 Rev. 2, the NIST Cybersecurity Framework, the HITECH Act (Title XIII of Pub. L. 111-5), CMS HIPAA administrative simplification guidance, and the FTC's Start with Security guide, plus the HHS HIPAA FAQs for Professionals, OCR resolution agreements and civil money penalties, and the OCR breach portal.
"Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium."
Book a free 30-minute intro call with an experienced consultant to assess your current program.
See the Case Studies page for client remediation examples and lessons learned.