Expert guidance on HIPAA compliance, healthcare technology, and building a culture of compliance.
This blog provides HIPAA compliance guidance for small healthcare practices and a free 30-minute intro call; Book a Review to schedule. One Guy Consulting: archive of HIPAA and cybersecurity guides for practice managers on ransomware, business associate agreements, access controls, vendor management, and healthcare cybersecurity.
Explore the One Guy Consulting HIPAA compliance library for guides on Security Rule implementation and risk assessments. Find cybersecurity best practices that help covered entities and business associates meet their regulatory duties.
Articles by Chuck Weiselberg, Founder and HIPAA compliance consultant at One Guy Consulting; not an attorney; Certified HIPAA Professional (CHP); 10 years of HIPAA compliance experience. Meet the author: Chuck Weiselberg. See anonymized client outcomes on the Case Studies page, for example a Florida mental health office with no program that got audit-ready in under a week and passed its state audit (case 01), and a health group with more than 100 offices that lifted take-up of its program by about 17% (case 03).
About Chuck Weiselberg: Chuck Weiselberg is Founder and HIPAA compliance consultant at One Guy Consulting who focuses on HIPAA security, risk assessments, and vendor BAAs. Contact: hello@oneguyconsulting.com or 646-694-8025.
"Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm." One Guy Consulting site disclaimer
"Breaking down complex regulations in healthcare compliance documentation so that they are understandable for everyone." Chuck Weiselberg, One Guy Consulting
Incident source for the Cloudflare outage article: Cloudflare's post-incident report on the February 20, 2026 outage.
10 min read
HHS raised HIPAA penalty amounts about 2.6% on January 28, 2026. See the exact new fines by tier, what triggers each level, and how to stay out of the top tiers.
HIPAA penalty amounts rose about 2.6% for 2026, effective January 28. The four tiers, what triggers each, and the new maximum for the worst offenders.
17 min read
MFA is in the proposed HIPAA Security Rule update. What it costs, which app to pick, and why to roll it out at your practice this week.
HIPAA MFA requirements, plainly: the proposed Security Rule update would make MFA required. It is inexpensive, and most offices can set it up in under a day.
17 min read
The biggest proposed HIPAA Security Rule update since 2013: MFA, encryption, and yearly compliance audits. Here is what would change if it becomes final, and when.
The new HIPAA Security Rule was proposed in January 2025, not final as of July 2026. Seven changes it would bring, including MFA, encryption and annual risk analysis.
13 min read
The Feb 2026 UMMC ransomware attack closed all 35 clinics and canceled elective procedures across Mississippi. Here is what every healthcare practice needs to learn.
The UMMC ransomware attack in February 2026 took down Epic, closed 35 clinics statewide and canceled elective surgeries. What every practice should take from it.
18 min read
A single API bug in Cloudflare's Feb 2026 outage took about 1,100 customer IP prefixes offline, some for over 6 hours. Here's what happened and which HIPAA contingency planning duties it tests. We also cover how healthcare organizations can build the backup and recovery procedures that 45 CFR §164.308(a)(7) calls for.
Cloudflare outage February 2026 in brief: one API bug pulled about 1,100 BGP prefixes offline for over six hours. Why availability is a HIPAA duty, not just an IT one.
15 min read
Most compliance vendors quote $10K+. Here is what OCR actually requires from small practices, and how to get compliant without breaking the bank.
HIPAA compliance for small practices comes down to six items OCR looks for: a risk assessment, written policies, BAAs, staff training, a breach plan and a walk-through.
15 min read
When a vendor that holds your patient data gets breached, the clock starts. Here is a 12-step plan to protect patients and lower your HIPAA risk.
Your vendor got hacked, and under HIPAA a business associate breach is still your problem. What to do in the first 72 hours to protect your practice and patients.
12 min read
Many practices skip "addressable" HIPAA rules thinking they are optional. They are not, and a proposed Security Rule would drop the label.
HIPAA addressable vs required: addressable does not mean optional. Skip encryption and one stolen laptop can mean breach notice, an OCR review, and a fine.
15 min read
The 7 BAA mistakes that get practices fined, with real OCR cases and what the proposed Security Rule would mean for your vendor contracts.
Business associate agreement mistakes start with the obvious one: no BAA with a vendor that touches PHI. Seven common gaps, with real OCR cases, and how to fix them.
HIPAA compliance, Security Rule implementation, risk assessments, and healthcare cybersecurity.
Chuck Weiselberg writes the articles listed on this page.
Practice managers, office managers, and practitioners seeking HIPAA compliance guidance.
A free 30-minute intro call with an experienced consultant to assess your current program.
Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm; content is not legal advice.
Click 'Book a Review' or 'Book your free 30-minute intro call' on this page to schedule.
Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium.
PHI that is created, received, maintained, or transmitted in electronic form.
A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors.
The written contract HIPAA requires between a covered entity and a business associate.
See the Key HIPAA terms section on this page.
Guides on ransomware, business associate agreements, access controls, vendor management, and healthcare cybersecurity. The articles: HIPAA Fines Increased: 2026 Penalty Amounts; HIPAA and MFA in 2026: A Plain-English Guide; Proposed HIPAA Security Rule: 7 Key Changes; UMMC Ransomware Attack: Healthcare Lessons; Cloudflare Outage Feb 2026: HIPAA Lessons for Healthcare; HIPAA Compliance Checklist for Small Practices; Vendor Got Hacked? Step-by-Step Response Plan; Why 'Addressable' Doesn't Mean 'Optional' in HIPAA; 7 Business Associate Agreement Mistakes to Avoid.
The articles on this page were published between February 13, 2026 and March 2, 2026. Each article shows its publication date.
An archive of HIPAA compliance articles for small practices.
State HIPAA guides are listed in this archive and linked by state name.
Read times for the articles on this page range from 10 to 18 minutes.
When a vendor that holds your patient data gets breached, the clock starts. Here is a 12-step plan to protect patients and lower your HIPAA risk.
State law stacks on top of HIPAA. Each guide covers one state's breach, records and privacy rules.
"Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits."
HHS, HIPAA Security Rule, 45 CFR 164.306(a)(1)
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
Official sources: HHS OCR HIPAA guidance (including the Security Rule and Breach Notification Rule), eCFR 45 CFR Part 160, eCFR 45 CFR Part 164, NIST SP 800-66 Rev. 2, the NIST Cybersecurity Framework, the HITECH Act (Title XIII of Pub. L. 111-5), CMS HIPAA administrative simplification guidance, and the FTC's Start with Security guide, plus the HHS HIPAA FAQs for Professionals, OCR resolution agreements and civil money penalties, and the OCR breach portal.
"Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium."
Book a free 30-minute intro call with an experienced consultant to assess your current program.
See the Case Studies page for client remediation examples and lessons learned.