HIPAA Basics
What a Business Associate Agreement Must Contain
The elements a HIPAA business associate agreement must include under 45 CFR 164.504(e), when a BAA is required, and the mistakes that make one unenforceable.
Healthcare compliance resource
Healthcare compliance, in plain language
An independent reference on HIPAA, the Security and Privacy Rules, risk analysis, and Washington State health-data law for compliance-minded organizations.
HIPAA Basics
Who HIPAA covers, what it protects, and how it is enforced.
HIPAA Basics
What Is HIPAA? A Plain-Language Overview
A plain-language overview of HIPAA: what the law is, what it protects, its main rules, and who has to follow it.
HIPAA Basics
Covered Entities vs. Business Associates
Understand the difference between covered entities and business associates under HIPAA, and why business associate agreements matter.
HIPAA Basics
What Is Protected Health Information (PHI)?
Learn what counts as protected health information under HIPAA, the 18 identifiers, and how de-identification removes data from HIPAA's scope.
HIPAA Basics
HIPAA Penalties and Enforcement
How OCR enforces HIPAA: complaints, investigations, corrective action, the tiered penalty structure, and possible criminal referrals.
Security Rule
Safeguards for electronic protected health information.
Security Rule
An Overview of the HIPAA Security Rule
What the HIPAA Security Rule requires: protecting ePHI through administrative, physical, and technical safeguards, and the role of required vs. addressable specs.
Security Rule
Administrative, Physical, and Technical Safeguards
A breakdown of the three Security Rule safeguard categories - administrative, physical, and technical - with practical examples for each.
Security Rule
Access Controls and Authentication
How the HIPAA Security Rule treats access control and authentication, including unique user IDs, least privilege, and multi-factor authentication.
Security Rule
Encryption and the Security Rule
Why encryption is addressable under HIPAA, how it relates to the breach safe harbor, and practical guidance for data at rest and in transit.
Security Rule
The Proposed Security Rule Updates: What to Watch
An overview of the proposed HIPAA Security Rule updates (NPRM). These changes are proposed and not yet final - what they would do and how to prepare.
Security Rule
Assigned Security Responsibility: The HIPAA Standard That Names a Person
The Security Rule requires you to identify a security official responsible for your policies and procedures. What the standard asks, and what it does not.
Security Rule
Addressable vs. Required: What HIPAA Implementation Specifications Really Mean
Addressable does not mean optional. How required and addressable HIPAA Security Rule implementation specifications differ, and the rationale you must document.
Security Rule
HIPAA Contingency Plan Requirements: Backup, Recovery, and Emergency Mode
The Security Rule's contingency plan standard has three Required specifications and two Addressable ones. What each asks for, and where practices fall short.
Privacy Rule
Rules for using, disclosing, and protecting health information.
Privacy Rule
An Overview of the HIPAA Privacy Rule
What the HIPAA Privacy Rule does: setting national standards for how PHI may be used and disclosed, and the rights it gives patients.
Privacy Rule
Permitted Uses and Disclosures of PHI
When HIPAA lets you use or disclose PHI without authorization, including treatment, payment, operations, and public-interest exceptions.
Privacy Rule
The Minimum Necessary Standard
How HIPAA's minimum necessary standard works, when it applies, when it does not, and how to operationalize it with role-based access.
Privacy Rule
Patient Rights Under the Privacy Rule
The rights HIPAA gives patients, including access to records, amendments, accounting of disclosures, restrictions, and confidential communications.
Privacy Rule
The HIPAA Right of Access: What OCR Actually Enforces
The 30-day clock, permitted fees, lawful denials, and the recurring failures that draw OCR right-of-access enforcement against practices of every size.
Risk & Audits
Risk analysis, breach response, and building a compliance program.
Risk & Audits
Risk Analysis vs. Gap Assessment: What Is the Difference?
A gap assessment checks controls against the Security Rule's list. A risk analysis is the required assessment of risks to ePHI. They are not interchangeable.
Risk & Audits
What Is a HIPAA Security Risk Analysis?
Understand the HIPAA security risk analysis: what it requires, why it is foundational, and how it differs from a gap assessment.
Risk & Audits
Conducting a Risk Assessment Step by Step
A practical, step-by-step walkthrough of a HIPAA security risk assessment, from scoping and data mapping to risk rating and remediation.
Risk & Audits
Breach Notification Requirements
What the HIPAA Breach Notification Rule requires: the breach definition, risk assessment factors, and who must be notified and when.
Risk & Audits
Building a HIPAA Compliance Program
The building blocks of a sustainable HIPAA compliance program: governance, risk analysis, policies, training, vendor management, and incident response.
Risk & Audits
9 Questions to Ask a HIPAA Risk Analysis Vendor Before You Sign
The Security Rule requires a technical and nontechnical evaluation of every location holding ePHI. Nine questions that reveal whether a vendor's scope matches it.
Risk & Audits
Security Risk Analysis for a Hospital: What Enterprise-Wide Scope Means
A hospital's risk analysis covers all ePHI the organization holds, not the EHR. What enterprise-wide scope includes, and why the federal SRA Tool tells larger organizations to look elsewhere.
Risk & Audits
Security Incident vs. Reportable Breach: Where the Line Falls
Not every incident is a breach. How the presumption of breach, the four-factor risk assessment, and the three exclusions decide whether you must notify.
Washington State
Washington health-data law beyond HIPAA, including the My Health My Data Act.
Washington State
Washington's My Health My Data Act Explained
An overview of Washington's My Health My Data Act: who it covers, consumer rights, the private right of action, and how it differs from HIPAA.
Washington State
Washington State Medical Records Retention
How long Washington providers should retain medical records, the difference from HIPAA's documentation retention, and where to verify the rules.
Washington State
Reporting a Health Data Breach in Washington
How health data breach reporting works in Washington: HIPAA federal duties, the state breach notification law, and the Attorney General's role.