16 min read
Is ChatGPT HIPAA Compliant? What Teams Must Know
ChatGPT is not HIPAA compliant by default. What healthcare teams need to know about BAAs, PHI in prompts, and building an AI acceptable use policy.
HIPAA Compliance Articles: Page 7
Articles on breach notification timelines, minimum necessary standards, and Security Rule requirements that healthcare IT teams need to understand. From encryption decisions to access logging, these resources help organizations implement technical safeguards that satisfy both the letter and spirit of HIPAA.
16 min read
18 min read
HIPAA Risk Assessment Template: Free Guide for 2026
What a HIPAA risk assessment must include and why free templates fall short. A step-by-step framework from NIST and HHS.
9 min read
HIPAA Dental Compliance for Offices & Practices
HIPAA compliance guide for dental offices. Covers dental-specific PHI, common violations, imaging security, and practical steps.
18 min read
How Much Does HIPAA Compliance Cost in 2026?
Honest HIPAA compliance costs by practice size. Breakdown of SRA, policies, training, and consulting with DIY vs platform comparison.
14 min read
Is Your HIPAA Compliance Badge a Risk?
Third-party HIPAA compliance badges may expose your organization to tracking violations. Learn how redirect chains and ad pixels create hidden risks.
7 min read
Vercel Security Incident: What to Do Now
Vercel disclosed a security incident on April 19, 2026 tied to a compromised OAuth chain. What is confirmed and what businesses should do.
8 min read
Bloodborne Pathogen Training for Healthcare
Bloodborne pathogen training for healthcare organizations. What OSHA training covers, why it matters, and why OGC does it better.
11 min read
Fraud, Waste and Abuse Training for Healthcare Organizations
Fraud, waste and abuse training for healthcare organizations. What FWA training covers, why it matters, and why OGC does it better.
23 min read
HIPAA De-Identification Requirements: Safe Harbor & Expert Methods
HIPAA de-identification methods explained: Safe Harbor vs Expert Determination, the 18 identifiers to remove, and mistakes that trigger penalties.
Key HIPAA terms used in these articles
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
- Protected Health Information (PHI)
- Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium (45 CFR 160.103).
- Electronic PHI (ePHI)
- PHI that is created, received, maintained, or transmitted in electronic form (45 CFR 160.103).
- Covered Entity
- A health plan, health care clearinghouse, or health care provider that transmits health information electronically (45 CFR 160.103).
- Business Associate
- A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors (45 CFR 160.103).
- Business Associate Agreement (BAA)
- The written contract HIPAA requires between a covered entity and a business associate (45 CFR 164.502(e), 164.504(e)).
- Security Rule
- The standards for protecting ePHI through administrative, physical, and technical safeguards (45 CFR Part 164, Subpart C).
- Security Risk Assessment (SRA)
- The accurate and thorough risk analysis the Security Rule requires you to conduct and document (45 CFR 164.308(a)(1)(ii)(A)).
- Breach Notification Rule
- After a breach of unsecured PHI, individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery, and HHS must be notified (45 CFR 164.400 to 164.414).