Technical deep-dives into HIPAA, HITECH, and HITRUST requirements. This resource provides specific configuration guides for PHI protection, Business Associate Agreement (BAA) negotiation strategies, and technical safeguards for health-tech innovators.
How many systems in your organization touch Protected Health Information? Not the ones your IT department provisioned. All of them. The 23 AWS S3 buckets your cloud billing statement reveals. The Salesforce instance storing patient...
Read the Guide
Every HIPAA risk assessment I review commits the same fundamental error. The document is titled "Risk Assessment." The content is a checklist. MFA: yes. Encryption: yes. Backup: yes. A series of binary answers telling OCR...
Read the Guide
In April 2012, a small cardiology practice in Phoenix paid $100,000 to settle an Office for Civil Rights (OCR) enforcement action targeting network security infrastructure. Phoenix Cardiac Surgery, a five-physician group, was cited for lacking...
Read the Guide
Which ChatGPT plan does your organization use? Not the plan the IT department approved. The plan your clinical staff actually uses. The one a medical assistant discovered through a colleague. The one a billing specialist...
Read the Guide
Before the 2013 HIPAA Omnibus Rule, Business Associates operated in a regulatory gray zone. Covered entities signed agreements. Vendors accepted them. HHS had no direct enforcement authority over the vendors themselves. When Advocate Medical Group...
Read the GuideOne compliance analysis per week from Josef Kamara, CPA, CISSP, CISA. Federal and private compliance, written for practitioners.