Cookeville Regional Medical Center confirmed that a 2025 ransomware attack resulted in the exposure of the personal and protected health information (PHI) of 337,917 individuals following a forensic investigation and extended data review process. Incident Identification And Timeline Cookeville Regional Medical Center in Cookeville, Tennessee identified a ransomware attack on July 14, 2025 and initiated … Read more
Navia Benefit Solutions, Inc. disclosed a data breach involving unauthorized access to its network between December 22, 2025, and January 15, 2026, affecting 2,697,540 individuals and requiring notification under the HIPAA Breach Notification Rule. Incident Details Navia Benefit Solutions, Inc. in Renton, Washington identified unauthorized activity within its systems on or around January 15, 2026. … Read more
The Office for Civil Rights investigates a HIPAA complaint by receiving and screening the submission for jurisdiction and timeliness, opening an investigation when acceptance criteria are met, notifying the complainant and the respondent, requesting and reviewing documentation and written statements, and pursuing resolution through voluntary compliance that may include corrective actions and a financial settlement. … Read more
HIPAA training for emergency care providers is the required workforce training that enables emergency department, urgent care, and prehospital personnel to use and disclose protected health information for treatment and related functions during time-sensitive care while maintaining safeguards required by the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule in high-noise, high-traffic, … Read more
Six Democratic senators have formally asked Labor Secretary Lori Chavez-DeRemer to explain reported reductions in Occupational Safety and Health Administration inspections, citations, and penalty assessments during 2025. Letter And Request For Information The senators sent a letter seeking answers about an apparent rollback of workplace safety enforcement and reduced oversight by the Department of Labor. … Read more
Many healthcare organizations believe they’re “HIPAA compliant” because they have policies on a shared drive, a training video for new hires, and an annual risk assessment file stored somewhere safe. The problem is that HIPAA compliance isn’t a stack of documents—it’s a living program. And the best way to keep that program real, current, and … Read more
NCLEX legal questions evaluate whether nursing practice complies with federal privacy requirements, consent standards, patient rights, mandatory reporting duties, advance care planning laws, and tort liability principles. Health Insurance Portability and Accountability Act of 1996 (HIPAA) The Health Insurance Portability and Accountability Act of 1996 is a U.S. federal law that protects the privacy and … Read more
Employee-Focused Curriculum Design Training content should be written for regulated staff performing real workflows rather than for compliance staff performing legal analysis.The instruction should translate the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule into job-relevant actions in scheduling, registration, clinical support, billing, and patient communications.Role relevance should be explicit so employees … Read more
Facebook is not HIPAA compliant for HIPAA Covered Entities or Business Associates because Facebook does not sign a HIPAA Business Associate Agreement and its services, including Facebook Messenger, are not intended to be used to create, receive, maintain, or transmit protected health information on behalf of regulated healthcare organizations. HIPAA requires a written HIPAA Business … Read more
Technology adoption in healthcare is often slower than in other sectors because patient safety obligations, HIPAA Privacy Rule and HIPAA Security Rule compliance requirements, complex interoperability and data governance constraints, reimbursement and contracting dependencies, and high operational risk from downtime or workflow disruption require extended evaluation, validation, and controlled implementation. Clinical systems affect diagnosis, treatment, … Read more
Microsoft Defender for Endpoint can support HIPAA compliance when it is implemented within a HIPAA-governed security program, used under Microsoft’s HIPAA Business Associate Agreement for applicable Microsoft online services, and configured and operated to meet HIPAA Security Rule administrative, physical, and technical safeguard requirements for systems that create, receive, maintain, or transmit electronic protected health … Read more
Identity and access management systems that provide single sign-on and multi-factor authentication are not inherently “HIPAA compliant” products, but they can support HIPAA compliance when implemented and configured to meet HIPAA Security Rule and HIPAA Privacy Rule requirements, and when the vendor signs a HIPAA Business Associate agreement if the service creates, receives, maintains, or … Read more
An EHR is HIPAA compliant only when the EHR system supports compliance with the HIPAA Security Rule and the HIPAA Privacy Rule through appropriate administrative, physical, and technical safeguards, the Covered Entity or Business Associate configures and uses the EHR to protect electronic protected health information, and the EHR vendor and any connected service providers … Read more
Ivy Pay is HIPAA compliant for payment processing by qualified, licensed therapists when Ivy Pay executes a Business Associate Agreement and the service is used and administered to protect the confidentiality, integrity, and availability of Protected Health Information, including the platform’s required SMS text notifications to clients. Ivy Pay is designed to reduce the disruption … Read more
Google Chrome is not HIPAA compliant as a standalone product, and its use in a HIPAA regulated environment is limited to serving as a managed user agent for accessing systems that are configured for HIPAA compliance and governed by a signed HIPAA Business Associate agreement where applicable. HIPAA applies to covered entities and business associates, … Read more
An email address is considered protected health information when it identifies an individual and is created, received, maintained, or transmitted by a HIPAA Covered Entity or Business Associate in connection with the individual’s healthcare, payment for healthcare, or enrollment in a health plan, and it is not protected health information when it is not linked … Read more
HIPAA violation penalties include civil monetary penalties assessed by the HHS Office for Civil Rights under a four-tier framework with inflation-adjusted per-violation amounts and calendar-year caps for identical violations, as well as separate criminal penalties that may apply to certain knowing conduct involving individually identifiable health information. Civil monetary penalties apply when the HHS Office … Read more
Microsoft Azure is not HIPAA compliant by itself, but Microsoft will sign a business associate agreement for Azure and Azure includes safeguards that can support compliance with the HIPAA Privacy Rule and HIPAA Security Rule when a covered entity configures and uses the services appropriately, noting that not all Azure services are included in the … Read more
Salesforce Marketing Cloud is not HIPAA compliant for HIPAA Covered Entities or Business Associates because Salesforce Marketing Cloud is not offered as a HIPAA-covered service for electronic protected health information and a HIPAA Business Associate Agreement is not available for Salesforce Marketing Cloud use involving protected health information. HIPAA compliance for a cloud service depends … Read more
Gmail can be made HIPAA compliant only by using Gmail through a Google Workspace plan that supports HIPAA compliance, executing Google’s HIPAA business associate agreement, and configuring administrative, technical, and operational controls so electronic protected health information is accessed only by authorized users and is protected in storage and transmission consistent with the HIPAA Security … Read more
The HIPAA conduit exception covers service providers that only transport protected health information from one point to another and do not create, receive, maintain, or access the information other than on a random or infrequent basis as necessary to perform the transportation service, with any storage limited to temporary, transmission-related buffering rather than retention. The … Read more
Endpoint encryption tools are HIPAA compliant when they are implemented as part of an organization’s HIPAA Security Rule risk management program to protect electronic protected health information stored on or accessed by endpoints, encryption keys are managed and access is controlled, and any vendor that creates, receives, maintains, or transmits protected health information on behalf … Read more
Claims submission and clearinghouse tools are HIPAA compliant when their use, configuration, and vendor obligations support permitted claims processing activities and meet applicable requirements under the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule, including execution of a HIPAA Business Associate Agreement when the vendor creates, receives, maintains, or transmits protected health … Read more
Venmo is not a HIPAA compliant platform for transmitting protected health information and it does not offer a Business Associate Agreement, but a covered entity may accept a patient-initiated payment through Venmo when use is limited to payment processing and no protected health information is created, received, maintained, or transmitted through the service. The HIPAA … Read more
Google Docs can be used in a HIPAA compliant manner to create, receive, maintain, or transmit Protected Health Information only when it is used within an eligible Google Workspace business plan, the service is configured to meet HIPAA Security Rule requirements, and Google’s standard Business Associate Addendum to the service agreement is executed before any … Read more
HIPAA allows email marketing only when the communication does not use or disclose protected health information or when a valid HIPAA authorization from the individual permits the use or disclosure, with limited HIPAA Privacy Rule exceptions that do not cover remote email marketing communications. The HIPAA Privacy Rule regulates the use and disclosure of protected … Read more
You send a HIPAA compliant email by confirming the message is a permitted use or disclosure under the HIPAA Privacy Rule, limiting the protected health information included to the minimum necessary when the HIPAA Minimum Necessary Rule applies, using an email system that meets HIPAA Security Rule safeguards for electronic protected health information, and preventing … Read more
An email service is HIPAA compliant when a HIPAA covered entity or business associate can use it to create, receive, maintain, and transmit electronic protected health information in a manner that supports compliance with the HIPAA Privacy Rule, the HIPAA Security Rule, and the HIPAA Breach Notification Rule through appropriate contractual terms, configuration controls, and … Read more
Emails are HIPAA compliant when a HIPAA Covered Entity or Business Associate uses email for a permitted purpose under the HIPAA Privacy Rule, limits the protected health information disclosed as required by the HIPAA Minimum Necessary Rule when applicable, and protects electronic protected health information in the email system with administrative, physical, and technical safeguards … Read more
Current HIPAA violation fines are civil monetary penalties assessed by the HHS Office for Civil Rights under a four-tier structure, with inflation-adjusted per-violation minimums and maximums and a calendar-year cap for identical violations, and separate criminal penalties that can apply to certain intentional conduct. For penalties assessed on or after January 28, 2026, the civil … Read more
Email archiving is HIPAA compliant when the archive stores and protects emails that contain protected health information as electronic protected health information under the HIPAA Security Rule, supports permitted use and disclosure controls under the HIPAA Privacy Rule, applies the HIPAA Minimum Necessary Rule where it applies, and is governed by documented retention, access, and … Read more
A recent study regarding cybersecurity insiders showed that many college students tend to be happy to break the HIPAA Rules. If paid the right price to do so, they are willing to steal and disclose patient information. The right price ranged from $10,000 to over $10 million. Professor Lawrence Sanders of the University of Buffalo, … Read more
Sending an email to patients is not a HIPAA violation when the message is permitted under the HIPAA Privacy Rule, uses reasonable safeguards to prevent unauthorized disclosure, limits protected health information to the HIPAA Minimum Necessary Rule when applicable, and applies the administrative, physical, and technical safeguards required by the HIPAA Security Rule for electronic … Read more
An email subject line has to be HIPAA compliant when it contains protected health information because the subject line is part of the message content that can be created, received, maintained, or transmitted by a HIPAA Covered Entity or Business Associate and is subject to the HIPAA Privacy Rule and, when handled electronically, the HIPAA … Read more
Yes, emails between providers need to be HIPAA compliant when they include protected health information or electronic protected health information and are sent by HIPAA Covered Entities or Business Associates, because the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Minimum Necessary Rule requirements apply to those communications even when the disclosure is permitted for … Read more
Zoom can be HIPAA compliant for HIPAA Covered Entities and Business Associates when the organization uses a Zoom business account that supports a Business Associate Agreement with Zoom Video Communications Inc., enables and applies the available security controls, configures the service to meet HIPAA Security Rule requirements, and limits uses and disclosures of protected health … Read more
Google Workspace is HIPAA compliant only for services with “included functionality” when a HIPAA Covered Entity or Business Associate uses a qualifying Google Workspace plan, configures the services to comply with the HIPAA Security Rule, and agrees to Google’s Business Associate Addendum before any Google Workspace service is used to create, receive, maintain, or transmit … Read more
Yesware is not HIPAA compliant for HIPAA Covered Entities or Business Associates because Yesware does not offer a HIPAA Business Associate Agreement and the platform’s email productivity and tracking functions can create, receive, maintain, or transmit electronic protected health information outside controls required by the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification … Read more
A HIPAA Covered Entity or Business Associate needs HIPAA-compliant email when email is used to create, receive, maintain, or transmit protected health information, because the HIPAA Privacy Rule and HIPAA Security Rule then require administrative, physical, and technical safeguards that prevent impermissible uses or disclosures and protect electronic protected health information during transmission and storage. … Read more
A new GuidePoint Security report reveals the growing threat of ransomware attacks as 2025 is documented as the most active year since the cybersecurity firm began its reports. Victims increased by 58% year-over-year with 2,287 unique victims in Q4 of 2025 alone. The GuidePoint Research and Intelligence Team (GRIT) reported December as the most active … Read more
Optimove can be HIPAA compliant for a HIPAA Covered Entity or Business Associate when Optimove signs a Business Associate Agreement that governs its handling of Protected Health Information and the service is used within the safeguards and obligations established for a business associate under HIPAA and the HITECH Act. Optimove is described as a customer-led … Read more
HIPAA compliant email providers are email services and secure email vendors that will sign a Business Associate Agreement when they create, receive, maintain, or transmit electronic protected health information and that offer the controls an organization needs to meet the HIPAA Privacy Rule and HIPAA Security Rule requirements for permitted use, access limitation, transmission security, … Read more
Webex by Cisco can be used in a HIPAA compliant manner when a Business Associate Agreement is in place and the platform is configured and used under organizational policies that control disclosures of Protected Health Information during provider-to-provider conferencing and telehealth encounters. HIPAA permits use of video conferencing tools for communications that involve Protected Health … Read more
Organ contractors need the same HIPAA certification as any other person who handles Protected Health Information, with some additional emphasis on the fast moving and highly sensitive nature of organ donation and transplant work. Same Core HIPAA Certification Requirements From a HIPAA standpoint, organ contractors are no different from other HIPAA Business Associate staff who … Read more
Zoho can be used in a HIPAA compliant manner for the majority of its cloud services after execution of the Zoho Business Associate Agreement and configuration of each in-scope service to meet HIPAA Security Rule safeguards, but some Zoho applications and some integrations fall outside the documented compliance scope and require administrative controls to prevent … Read more
Microsoft OneNote can be used in a HIPAA-compliant manner only when a HIPAA Covered Entity or Business Associate uses it under a Microsoft 365 plan that supports HIPAA compliance, has Microsoft’s HIPAA Business Associate Agreement in place for the in-scope services that store or transmit electronic protected health information, configures those services to meet HIPAA … Read more
HIPAA compliance software is a category of tools used by HIPAA Covered Entities and Business Associates to manage, document, and operationalize HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule obligations through workflows that support risk analysis, risk management, policies and procedures, online HIPAA training records, incident response documentation, and vendor and Business … Read more
Telephone triage software is HIPAA compliant when triage calls and related documentation use permitted treatment communications under the HIPAA Privacy Rule, any electronic protected health information created by voice platforms, recordings, call logs, triage notes, and messaging features is protected with safeguards that meet the HIPAA Security Rule, breach response processes meet the HIPAA Breach … Read more
Using PHI to confirm a patient’s identity is not a HIPAA violation when the information is used or disclosed for a permitted purpose under the HIPAA Privacy Rule, the workforce member verifies identity using reasonable procedures, and the disclosure is limited to the HIPAA Minimum Necessary Rule when that standard applies. The HIPAA Privacy Rule … Read more
Document scanning software is HIPAA compliant when scanning, optical character recognition, storage, transmission, and user access workflows protect any protected health information under the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule, and when the vendor signs a HIPAA Business Associate Agreement for any service in which the vendor creates, receives, maintains, … Read more
E-prescribing software is HIPAA compliant only when the software and its supporting services protect electronic protected health information under the HIPAA Security Rule, e-prescribing workflows limit uses and disclosures under the HIPAA Privacy Rule and the HIPAA Minimum Necessary Rule, and the e-prescribing vendor and any connected service providers that create, receive, maintain, or transmit … Read more
Campaign Monitor is not HIPAA compliant for uses that involve protected health information because it does not offer a Business Associate Agreement for HIPAA Covered Entities or Business Associates, so it should not be used to create, receive, maintain, or transmit protected health information in email marketing or related email automation. A Business Associate Agreement … Read more
eFileCabinet can be used in a HIPAA-compliant manner for storing or sharing electronic protected health information when the organization implements the available security, access, and audit controls, configures them correctly, and signs a Business Associate Agreement with eFileCabinet before using the platform for that purpose. eFileCabinet is a document management and storage solution that offers … Read more
Google Voice is HIPAA compliant only when used as Google Voice for Workspace under a business Google Workspace or Cloud Identity plan with a signed Business Associate Addendum with Google, and when the organization configures and manages the service to comply with the HIPAA Privacy Rule and HIPAA Security Rule, and the free consumer version … Read more
A federal judge approved the settlement of a combined class action lawsuit for $1 million that was filed against Community First Medical Center, doing business as Community First Medical Center. The Chicago, IL, medical center encountered unauthorized third-party access to its network on July 12, 2023, resulting in a data breach. Files that contain the … Read more
Microsoft Word can be used in a HIPAA-compliant manner only when it is deployed under a qualifying Microsoft 365 or Office 365 subscription that is covered by Microsoft’s HIPAA Business Associate Agreement, configured to meet HIPAA Security Rule administrative, physical, and technical safeguard requirements, and used under workforce policies that prevent impermissible uses and disclosures … Read more
Alta is not HIPAA compliant for HIPAA Covered Entities or Business Associates because Alta does not offer a HIPAA Business Associate Agreement and the service is not represented as supporting HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule requirements for electronic protected health information. HIPAA requires a HIPAA Business Associate Agreement when … Read more
Medical records can be sent by email when the disclosure is permitted or required by the HIPAA Privacy Rule and the email transmission is protected with reasonable safeguards consistent with the HIPAA Security Rule for electronic protected health information, including honoring an individual’s request to receive their own records by email after being advised of … Read more
Wufoo is not HIPAA compliant for HIPAA Covered Entities or Business Associates because Wufoo will not sign a Business Associate Agreement and its website does not describe HIPAA compliance measures for handling Protected Health Information. Wufoo is an online form builder used by individuals and businesses to create and manage online forms, including surveys, contact … Read more
HIPAA certification is generally treated as current for 12 months, because industry best practice in the healthcare sector is to provide HIPAA training annually. There is no formal government rule that stamps an expiry date on your certificate, but employers, auditors, and clients usually expect your most recent HIPAA training to be within the last … Read more
Online HIPAA training for pharmacy staff is a structured way to teach every workforce member how to protect protected health information during prescription processing, patient counseling, insurance billing, and day to day pharmacy operations. Pharmacies handle PHI in places where the public is nearby, conversations move quickly, and multiple systems are used at once. That … Read more
There is no single official HIPAA certification issued by the U.S. government, but you can still earn HIPAA certification online from reputable training providers and the most important factor is choosing a provider with strong credibility, not just the lowest price. No Government Issued HIPAA Certificate HIPAA does not create a formal government “license” or … Read more
On December 10, 2020, OCR published a Notice of Proposed Rulemaking that specified the HIPAA improvements to the Privacy Rule according to replies to its December 2018 RFI. The suggested modifications are minimal and do not include the changes in the HIPAA Privacy Rule that healthcare sector stakeholders are lobbying for. The majority of the … Read more
Website contact forms are HIPAA compliant only when they are designed to prevent impermissible disclosures of protected health information and, when the form transmits or stores protected health information, the form platform, hosting provider, and any connected services sign a HIPAA Business Associate agreement and operate with HIPAA Security Rule safeguards for access control, audit … Read more
Selection criteria for HIPAA training should require content created and maintained by HIPAA subject matter experts, current update controls, an employee-focused curriculum that teaches the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule through realistic scenarios, strong administrator oversight and audit-ready documentation, targeted coverage of social media and artificial intelligence risks, flexibility … Read more
The civil penalty for an unknowing HIPAA violation is a civil monetary penalty assessed by the U.S. Department of Health and Human Services Office for Civil Rights under the lowest culpability tier when the organization did not know and, by exercising reasonable diligence, would not have known of the violation, with an inflation-adjusted minimum penalty … Read more
HIPAA applies to therapists when the therapist is a HIPAA Covered Entity as a healthcare provider that transmits health information in electronic form in connection with a HIPAA standard transaction, or when the therapist is part of an organization that is a HIPAA Covered Entity, and HIPAA can also apply to therapists and counseling practices … Read more
Apple Invites is not HIPAA compliant for HIPAA Covered Entities or Business Associates because Apple does not offer a HIPAA Business Associate Agreement for Apple Invites and the service is not provided as a HIPAA-eligible platform for creating, receiving, maintaining, or transmitting electronic protected health information. HIPAA requires a written HIPAA Business Associate Agreement when … Read more
Google Calendar is HIPAA compliant for entering, receiving, storing, or sharing Protected Health Information when it is used as part of a business Google Workspace account that is configured to comply with HIPAA and covered by the HIPAA Business Associate Addendum to Google’s Service Agreement. Google Calendar is a time management and calendar scheduling service … Read more
Rural hospital, Memorial Hospital and Manor, in Bainbridge, Georgia, consented to settle a class action litigation involving a ransomware attack and data breach in November 2024. The hospital noticed the cyberattack on November 2, 2024 after its EMR system, website, and email became unavailable. On November 3, 2024, Memorial Hospital and Manor notified patients about … Read more
The Google services formerly known as Google Hangouts are HIPAA compliant for creating, receiving, transmitting, and sharing Protected Health Information when they are used as Google Chat and Google Meet within a Google Workspace account that supports HIPAA compliance and the HIPAA Covered Entity or Business Associate agrees to Google’s Business Associate Addendum before any … Read more
HelloFax, now offered as Dropbox Fax within Dropbox Sign, can support HIPAA compliance when a healthcare organization subscribes to a Standard or Premium Dropbox Sign business plan, enters into the Dropbox Sign Business Associate Agreement, and configures the service and user practices to meet applicable HIPAA Security Rule safeguards for electronic protected health information. HelloFax … Read more
Insider threats in healthcare are risks to patient information, clinical systems, and operations that originate from members of the workforce or other trusted users with authorized access who misuse that access intentionally or who cause harm through errors, policy violations, or compromised credentials, resulting in impermissible use or disclosure of protected health information or disruption … Read more
The seven elements of an effective compliance program are policies and procedures, compliance leadership and oversight, training and education, effective lines of communication, internal monitoring and auditing, enforcement of standards through disciplinary guidelines, and response and prevention through corrective action. The Office of Inspector General uses these elements to describe how a healthcare organization prevents, … Read more
Patient outcomes tools are not HIPAA compliant by product label, but they can be used in a HIPAA-compliant manner when the tool and connected services handle protected health information under a signed HIPAA Business Associate agreement and the implementation meets HIPAA Security Rule safeguards for access control, audit controls, integrity, person or entity authentication, and … Read more
Non-profit health system, MedStar Health, manages 10 hospitals around the Baltimore-Washington metro region. On October 4, 2025, it discovered a cyberattack and data breach. The forensic investigation revealed that an unauthorized third party acquired access to part of its internal systems that stored patient information from September 12, 2025 to September 16, 2025. MedStar Health … Read more
The 18 PHI identifiers are the specific categories of identifiers that must be removed under the HIPAA Privacy Rule safe harbor de-identification standard, and they are names; geographic subdivisions smaller than a state with limited ZIP code handling; all elements of dates related to an individual other than year with a special rule for ages … Read more
Secure file transfer software using Secure File Transfer Protocol or managed file transfer is HIPAA compliant when the implementation protects electronic protected health information with safeguards required by the HIPAA Security Rule, limits uses and disclosures under the HIPAA Privacy Rule, supports breach response obligations under the HIPAA Breach Notification Rule, and includes a signed … Read more
Campaigner is not HIPAA compliant for any use that involves protected health information because it does not sign a Business Associate Agreement with HIPAA Covered Entities or Business Associates, so it should not be used to create, receive, maintain, or transmit protected health information in email marketing, automated messaging, or related contact management. A Business … Read more
You apply for HIPAA certification by enrolling in an online HIPAA training and certification course, and the most important decision you make is choosing a reputable provider rather than just the cheapest option. Choose A Reputable HIPAA Certification Provider Start by looking for a provider that specializes in HIPAA training, not a generic training site … Read more
Patch management software is not HIPAA compliant by product label, but it can support HIPAA compliance when it is implemented as part of a documented patch management program that meets HIPAA Security Rule administrative and technical safeguard requirements for risk analysis, risk management, system maintenance, protection from malicious software, audit controls, and access control, and … Read more
The HIPAA Omnibus Rule of 2013 mandated major updates to the HIPAA Privacy Rule, HIPAA Security Rule, HIPAA Enforcement Rule, and HIPAA Breach Notification Rule by implementing Health Information Technology for Economic and Clinical Health Act requirements, expanding direct compliance obligations and liability for Business Associates and their subcontractors, tightening rules on marketing and the … Read more
Mirion Medical identified five high-severity vulnerabilities in its EC2 Software NMIS BioDose software and issued patches to correct the problem. An attacker can successfully exploit the vulnerabilities to get unauthorized access to the software, alter program executables, obtain sensitive data, and possibly execute code remotely. HIPAA-compliant Healthcare providers use the Mirion Medical EC2 Software NMIS … Read more
Protected health information is individually identifiable health information that is created or received by a HIPAA covered entity or business associate and relates to a person’s health condition, health care, or payment for health care, and examples include clinical information, billing information, and related identifiers when the information identifies the person or can be used … Read more
Google Sheets is HIPAA compliant for creating, managing, and sharing spreadsheets that contain Protected Health Information when an organization uses Google Sheets through a Google Workspace plan that supports HIPAA compliance, configures Google Drive to control access to files saved as Google Sheets, and reviews and accepts Google’s Business Associate Addendum to the Workspace Service … Read more
HIPAA training for emergency dispatchers is the required workforce training that establishes how dispatch personnel may collect, use, and disclose protected health information during call intake, triage, resource coordination, and interagency communications while maintaining safeguards required by the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule across recorded lines, computer-aided dispatch platforms, … Read more
Microsoft Authenticator can support HIPAA compliance when it is used with Microsoft Entra ID under an eligible Microsoft 365 subscription that is covered by Microsoft’s HIPAA Business Associate Agreement for in-scope services, configured to meet HIPAA Security Rule access control and person or entity authentication safeguards, and managed through documented administrative procedures and workforce practices. … Read more
Coda can support HIPAA-compliant use only on its Enterprise plan with a signed HIPAA Business Associate Agreement in place and with product restrictions that limit how electronic protected health information is stored, shared, and processed inside the platform. HIPAA Covered Entities and Business Associates need a HIPAA Business Associate Agreement before a vendor creates, receives, … Read more
Marketo can be HIPAA compliant when a HIPAA Covered Entity or Business Associate uses the platform through Adobe’s healthcare offering, obtains an executed Business Associate Agreement from Adobe that covers the applicable services, and configures and operates the environment to meet HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule requirements for electronic … Read more
Individually identifiable health information is health information, including demographic information, that relates to an individual’s past, present, or future physical or mental health or condition, the provision of health care to the individual, or the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or … Read more
The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is creating a video presentation to discuss the needs of the HIPAA Security Rule risk management process and has asked HIPAA-regulated entities to submit risk management questions. The risk analysis is a basic component of the HIPAA Security Rule that identifies the … Read more
A HIPAA investigation by the HHS Office for Civil Rights can take from several weeks to multiple years, depending on how the matter is opened and scoped, the volume of evidence requested, the number of organizations involved, and whether corrective action, settlement terms, or a civil money penalty process extends the timeline. Most matters received … Read more
Digital patient intake and registration is HIPAA compliant only when the online forms, storage, and transmission methods protect electronic protected health information under the HIPAA Security Rule, intake workflows limit uses and disclosures under the HIPAA Privacy Rule and the HIPAA Minimum Necessary Rule, and the form or intake platform provider will sign a HIPAA … Read more
An EMR is HIPAA compliant only when the system has safeguards that support compliance with the HIPAA Security Rule and HIPAA Privacy Rule, the organization configures and uses the EMR to protect electronic protected health information, and the EMR vendor and any connected service providers that create, receive, maintain, or transmit electronic protected health information … Read more
Protected health information is individually identifiable health information that is created, received, maintained, or transmitted by a HIPAA Covered Entity or Business Associate in any form or medium, while electronic protected health information is the subset of protected health information that is created, received, maintained, or transmitted in electronic form and is subject to the … Read more
Buying HIPAA training requires selecting an online program that teaches workforce members how to apply the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule in day-to-day work and produces training records that stand up to audit review. Workforce Coverage and Training Cadence All workforce members must receive HIPAA training. Annual HIPAA training … Read more
Texas HB 300 expands individual privacy protections by amending the Texas Medical Records Privacy Act in Texas Health and Safety Code Chapter 181 to apply medical privacy obligations to a broader range of organizations than HIPAA, restrict certain disclosures of electronic protected health information to narrower categories unless the individual authorizes the disclosure, impose Texas-specific … Read more
Keep online HIPAA training records for each trainee for at least six years from the date the record was created or last in effect, whichever is later, including items such as completion certificates, timestamps, assessment results, and attestations so they can be produced on request. The precise regulations are: Privacy Rule training requirement:“A covered entity … Read more
Trinity Health Corporation, the Catholic Health System based in Livonia, Michigan, and co-defendants Valley Surgical Specialists Medical Group, Inc., Rame Deme Iberdemaj, and Daniel Evan Swartz, MD, have decided to resolve a class action lawsuit associated with a 2021 data breach prompted by its use of Accellion FTA, a file transfer platform. On or about … Read more
Slack is not HIPAA compliant, and while Slack Enterprise Grid can be used for HIPAA-compliant communications after execution of a Business Associate Agreement and specific configuration steps, the permitted uses are limited and exclude several common healthcare communication scenarios. Slack Enterprise Grid is a separate enterprise version of the platform that differs from standard Slack … Read more
FaceTime can be used for HIPAA regulated communications only in limited circumstances because Apple does not offer a business associate agreement for FaceTime, so permissibility depends on whether FaceTime is treated as a conduit and on whether the HIPAA Covered Entity applies controls required by the HIPAA Privacy Rule and HIPAA Security Rule. A business … Read more
The HIPAA emergency exception is a common shorthand for the fact that HIPAA’s legal requirements remain in effect during an emergency, while the HIPAA Privacy Rule and HIPAA Security Rule include built-in flexibilities that permit alternate workflows, emergency disclosures, and emergency-mode operations when normal safeguards and systems are disrupted. Definition and Scope HIPAA does not … Read more
iCloud is not HIPAA compliant and cannot be used by HIPAA Covered Entities or Business Associates to create, receive, maintain, transmit, store, sync, or share electronic protected health information because Apple’s iCloud Terms of Service prohibit that use and Apple does not offer a business associate agreement for iCloud. Healthcare organizations evaluate iCloud because it … Read more
HIPAA is important because it establishes enforceable federal standards that limit how protected health information may be used and disclosed, require safeguards for electronic protected health information, give individuals defined rights over their health information, impose breach notification duties when unsecured protected health information is compromised, and provide a regulatory enforcement structure that applies to … Read more
Online HIPAA training selection requires documented workforce coverage, current and accurate regulatory content, operationally realistic scenarios, and reporting that supports audit response. Workforce Coverage and Training Frequency All workforce members must receive HIPAA training. Annual HIPAA training is industry best practice and supports consistent reinforcement of the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA … Read more
Nebraska Attorney General Mike Hilgers took legal action over the 2024 Change Healthcare data breach, which has been permitted to move forward after a motion to dismiss was denied. The litigation registered in Lancaster County District Court in December 2024 referred to Optum, UnitedHealth and Change Healthcare as defendants. The legal action claimed the defendants … Read more
Voicemail transcription tools are HIPAA compliant when voicemail and transcription content that includes protected health information is handled only for permitted treatment, payment, or healthcare operations purposes, protected with safeguards that meet the HIPAA Security Rule, used and disclosed in line with the HIPAA Privacy Rule, supported by breach response procedures under the HIPAA Breach … Read more
Twilio SendGrid is not HIPAA compliant for HIPAA Covered Entities or Business Associates because it is not a HIPAA-eligible service, it does not support HIPAA-compliant transmission of electronic protected health information, and Twilio does not sign a HIPAA Business Associate Agreement for SendGrid. HIPAA requires a written HIPAA Business Associate Agreement when a vendor creates, … Read more
Salesforce Pardot, also known as Marketing Cloud Account Engagement, is not HIPAA compliant for handling electronic protected health information because Salesforce does not make a HIPAA Business Associate Agreement available for Pardot in a way that permits Covered Entities or Business Associates to use the platform to create, receive, maintain, or transmit protected health information … Read more
The Qilin ransomware group launched an attack on June 3, 2024, and encrypted files on its system. Before encrypting the files in the victim’s network, the attacker exfiltrated data. The ransomware attack prompted substantial trouble to Synnovis’ business operations, disrupting a lot of its pathology services. Synnovis mentioned that the ransomware attack affected almost all … Read more
Google Bard is not HIPAA compliant for HIPAA Covered Entities or Business Associates because it is not offered under a HIPAA Business Associate Agreement and it is not designed to create, receive, maintain, or transmit electronic protected health information under HIPAA Privacy Rule and HIPAA Security Rule requirements. HIPAA compliance for third-party services that handle … Read more
Microsoft Forms is HIPAA compliant only when it is used as an in-scope service within an eligible Microsoft 365 or Office 365 subscription under an executed Microsoft HIPAA Business Associate Agreement, configured to meet HIPAA Security Rule administrative, physical, and technical safeguard requirements, and operated under HIPAA Privacy Rule controls that limit uses and disclosures … Read more
Twilio can be HIPAA compliant when a HIPAA Covered Entity or Business Associate executes Twilio’s Business Associate Agreement or Business Associate Addendum for Twilio HIPAA-eligible products and then designs, configures, and operates the implementation so that electronic protected health information is created, received, maintained, and transmitted under controls that meet HIPAA Privacy Rule, HIPAA Security … Read more
According to the US Healthcare Cyber Resilience Survey conducted by EY and KLAS Research, 7 of 10 healthcare institutions have encountered substantial business interruption because of cyberattacks in the last two years. The survey involved the participation of 100 healthcare professionals in charge of cybersecurity decisions in their companies. Companies suffered an average of 5 … Read more
Mend can be used in a HIPAA compliant manner when a HIPAA Covered Entity or Business Associate executes a HIPAA Business Associate agreement with Mend, limits use to the services and configurations covered by that agreement, and implements administrative, physical, and technical safeguards for electronic protected health information under the HIPAA Privacy Rule, HIPAA Security … Read more
Microsoft Intune can support HIPAA compliance when it is used as part of a Microsoft 365 deployment that has Microsoft’s HIPAA Business Associate Agreement in place for in-scope services, is configured to meet HIPAA Security Rule administrative, physical, and technical safeguard requirements, and is governed by HIPAA Privacy Rule and HIPAA Minimum Necessary Rule policies … Read more
Microsoft Bookings is HIPAA compliant only when it is used within an eligible Microsoft 365 environment under Microsoft’s HIPAA Business Associate Agreement for in-scope services, configured to meet HIPAA Security Rule safeguards, and operated under HIPAA Privacy Rule controls that limit collection, use, and disclosure of protected health information. Microsoft Bookings is an appointment scheduling … Read more
Network Solutions is not HIPAA compliant for HIPAA Covered Entities or Business Associates because Network Solutions does not offer a HIPAA Business Associate Agreement for its email, web hosting, or related services and those services are not positioned for creating, receiving, maintaining, or transmitting electronic protected health information under HIPAA Privacy Rule and HIPAA Security … Read more
HIPAA authorization requirements are the HIPAA Privacy Rule conditions and required elements that must be met before a HIPAA Covered Entity or Business Associate uses or discloses protected health information for purposes that are not otherwise permitted or required, with written authorization that is specific, time limited, and signed by the individual or the individual’s … Read more
The HIPAA Privacy Rule most affects EMS personnel because it governs what patient information can be collected, discussed, documented, and shared during dispatch, on-scene care, transport, handoff, and follow-up communications in public and multi-agency environments where incidental disclosure risks are common. Operational Impact of the HIPAA Privacy Rule EMS work involves rapid information exchange for … Read more
GetResponse is not HIPAA compliant for uses that involve protected health information because it does not offer a Business Associate Agreement for HIPAA Covered Entities or Business Associates, so it should not be used to create, receive, maintain, or transmit protected health information through email marketing, automation, landing pages, or contact management. A Business Associate … Read more
A Montefiore Medical Center’s former business clerk and his partner have admitted to taking numerous patient data and using the stolen information to defraud government institutions out of about $1 million. Wilkins Estrella, 40 years old, living in Hackensack, New Jersey, was employed at Montefiore Medical Center for more or less ten years. His employment … Read more
Backup and disaster recovery systems are HIPAA compliant when they protect electronic protected health information with safeguards required by the HIPAA Security Rule contingency planning standard, limit uses and disclosures under the HIPAA Privacy Rule, support breach assessment and notification under the HIPAA Breach Notification Rule, and include a signed HIPAA Business Associate Agreement when … Read more
HIPAA was created to improve the portability and continuity of health insurance coverage for workers and their families, reduce administrative burden through national standards for electronic health care transactions and identifiers, and support program integrity through measures addressing waste, fraud, and abuse, while later implementing federal protections for patient information through the HIPAA Privacy Rule, … Read more
macOS can be used in a HIPAA-compliant manner when it is deployed and managed under a documented HIPAA Security Rule program that applies administrative, physical, and technical safeguards to endpoints that create, receive, maintain, or transmit electronic protected health information, and when consumer Apple cloud services such as iCloud are not used for electronic protected … Read more
Wild Apricot is not HIPAA compliant for HIPAA Covered Entities or Business Associates because the service is not offered with a HIPAA Business Associate Agreement and its membership management and communications features can create, receive, maintain, or transmit electronic protected health information outside the safeguards required by HIPAA. HIPAA requires a written HIPAA Business Associate … Read more
Google Drive can be used in a HIPAA-compliant manner to store and share electronic protected health information only when it is provided through an eligible Google Workspace offering, a Business Associate Agreement is executed with Google before any protected health information is uploaded, and the covered entity or business associate configures and administers Google Drive … Read more
The HIPAA rules for dentists require any dentist or dental practice that qualifies as a HIPAA Covered Entity, and any Business Associate handling protected health information on the practice’s behalf, to comply with the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule, including limits on uses and disclosures, patient rights, administrative safeguards, … Read more
ExtraHop, the network detection and response (NDR) company, published its 2025 Global Threat Landscape Report where it revealed that ransomware groups are running fewer attacks than last year but are taking on a more targeted strategy using sneaky tactics to realize more significant results. Ransomware groups are conducting more targeted, sophisticated attacks, allowing them to … Read more
Oracle Eloqua can support HIPAA-compliant use only when the organization purchases and uses the Oracle Eloqua HIPAA Advanced Data Security Add-on Cloud Service, executes a HIPAA Business Associate Agreement with Oracle for the applicable services, and limits campaign design, data collection, user access, and integrations to HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach … Read more
Prior authorization platforms are HIPAA compliant only when the platform and its supporting services protect electronic protected health information under the HIPAA Security Rule, prior authorization workflows limit uses and disclosures under the HIPAA Privacy Rule and the HIPAA Minimum Necessary Rule, and the platform provider and any connected vendors that create, receive, maintain, or … Read more
eFax services are HIPAA compliant when the service is used under a plan that supports protected health information, the provider signs a HIPAA Business Associate Agreement, and the covered entity or business associate configures and operates the service with safeguards and procedures that meet requirements under the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA … Read more
Dropbox can be used in a HIPAA-compliant manner to store, sync, and share electronic protected health information only when a covered entity or business associate uses an eligible Dropbox team plan, executes a Business Associate Agreement with Dropbox before uploading any protected health information, and configures and administers the service to meet requirements of the … Read more
Eastern Radiologists in North Carolina has decided to resolve a class action lawsuit associated with a 2023 data breach for $3.25 million. The data breach report submitted to the HHS’s Office for Civil Rights indicated that the protected health information (PHI) of 886,746 individuals was affected. The Eastern Radiologists discovered the data breach on November … Read more
Airtable is HIPAA compliant for HIPAA Covered Entities and Business Associates only when they subscribe to an Enterprise Scale plan, enter into a Business Associate Agreement with Airtable, and use the platform within Airtable’s stated HIPAA limitations for storing and transmitting Protected Health Information. Airtable is a customizable business management platform with automation capabilities that … Read more
Initials are considered protected health information when they identify an individual or can reasonably be used with other available information to identify the individual and they are linked to health information maintained or transmitted by a HIPAA Covered Entity or Business Associate, and initials are not protected health information when they are not identifiable to … Read more
The HIPAA breach notification requirements require HIPAA covered entities and business associates to identify and investigate impermissible uses or disclosures of unsecured protected health information, perform the required breach risk assessment, and provide notice to affected individuals and, in specified circumstances, to the Secretary of the U.S. Department of Health and Human Services and the … Read more
Healthcare Cybersecurity Training helps with HIPAA Safe Harbor by showing that recognized security practices are not just written in policies but actively taught, reinforced, and followed by the workforce over time. HIPAA Safe Harbor asks whether a Covered Entity or Business Associate has had recognized security practices in place for at least twelve months before … Read more
Remote support tools are not HIPAA compliant by product label, but they can be used in a HIPAA-compliant manner when they are configured to meet HIPAA Security Rule technical safeguard requirements for access control, person or entity authentication, audit controls, integrity, and transmission security, and when the vendor will sign a HIPAA Business Associate agreement … Read more
Mozilla Firefox is not HIPAA compliant as a standalone web browser, and it is only suitable for HIPAA regulated use when it is kept supported and patched, centrally managed, and used in a technical environment that prevents impermissible uses or disclosures of electronic protected health information. HIPAA compliance obligations apply to HIPAA Covered Entities and … Read more
LiveChat is not HIPAA compliant by product label, but it can be used in a HIPAA-compliant manner when it is configured and governed to meet HIPAA Security Rule safeguards for access control, audit controls, integrity, person or entity authentication, and transmission security, and when LiveChat will sign a HIPAA Business Associate agreement for the deployment … Read more
Skagit County Public Hospital District No. 1, also known as Skagit Regional Health, which manages Skagit Regional Hospital in Mount Vernon, Washington, has decided to resolve class action litigation associated with its use of Meta Pixel and other tracking tools on its website, which may have exposed patient data to third parties. Skagit Regional Health, … Read more
HIPAA training for emergency situations is mandatory workforce training that prepares personnel to apply the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule during disasters, outages, mass-casualty events, and other urgent conditions where care delivery and communications change but HIPAA obligations remain in effect. Training Requirement and Timing All workforce members must … Read more
HIPAA violations can lead to termination when an employer’s sanctions policy authorizes termination for the conduct at issue and the facts show a workforce member violated the HIPAA Privacy Rule, the HIPAA Security Rule, the HIPAA Breach Notification Rule, or the organization’s related privacy and security policies and procedures, with termination often used for intentional … Read more
If accused of a HIPAA violation, promptly preserve relevant records, notify the designated privacy and security officials, assess whether protected health information was used or disclosed in a manner not permitted by the HIPAA Privacy Rule or safeguarded as required by the HIPAA Security Rule, take immediate containment and corrective steps, and prepare a documented … Read more
A person can go to jail for a HIPAA violation when the conduct is a knowing and unlawful obtaining, using, or disclosing of individually identifiable health information, and the case is pursued as a criminal matter by the U.S. Department of Justice rather than treated as a civil compliance enforcement action by the Office for … Read more
A HIPAA mobile device policy that best supports compliance is a written, enforced set of rules that restricts when mobile devices may access, create, receive, maintain, or transmit electronic protected health information and that implements HIPAA Security Rule administrative, physical, and technical safeguards for device access control, encryption, transmission security, audit controls, integrity protections, incident … Read more
HIPAA is a United States federal law enacted in 1996 that, through its Administrative Simplification provisions and implementing regulations, sets national requirements for HIPAA Covered Entities and Business Associates to standardize certain electronic healthcare transactions and to protect the privacy and security of protected health information through the HIPAA Privacy Rule, HIPAA Security Rule, and … Read more
HIPAA training typically expires after one year, because best practice in the United States healthcare sector is to provide annual HIPAA training to all workforce members. Some HIPAA training vendors issue certificates with longer expiry dates, but stretching training beyond one year is strongly not recommended, because it increases the risk that staff rely on … Read more
The HHS’ Office for Civil Rights reached a $182,000 settlement with five Delaware healthcare companies to take care of alleged HIPAA Privacy and HIPAA Breach Notification Rules violations. The settlement is about the publishing of the protected health information (PHI) of patients on social media without first getting HIPAA-compliant consent to use PHI for something … Read more
HIPAA compliant text messaging is the use of a texting method that allows a HIPAA Covered Entity or Business Associate to send and receive messages that include protected health information while meeting HIPAA Privacy Rule use and disclosure limits, applying HIPAA Minimum Necessary Rule controls when applicable, and implementing HIPAA Security Rule administrative, physical, and … Read more
Self-attestation in HIPAA training encourages passive learning because it measures completion without testing comprehension, which lowers retention and leaves organizations unable to show that workforce members can apply the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule requirements to their job tasks. Self-Attestation Rewards Speed Over Attention A self-attestation model signals that … Read more
Microsoft Excel can support HIPAA-compliant workflows only when it is used under a qualifying Microsoft 365 or Office 365 business subscription that is covered by Microsoft’s HIPAA Business Associate Agreement, configured to meet HIPAA Security Rule safeguard requirements, and controlled by organizational policies that prevent impermissible uses and disclosures of protected health information. Excel is … Read more
HIPAA applies to pharmacies when the pharmacy qualifies as a HIPAA Covered Entity by furnishing, billing for, or being paid for health care and transmitting health information electronically in connection with a standard transaction, and HIPAA also applies to vendors that create, receive, maintain, or transmit protected health information for a pharmacy as Business Associates. … Read more
Autopilot, now branded as Ortto, is not HIPAA compliant for HIPAA Covered Entities or Business Associates because the service is not offered with a HIPAA Business Associate Agreement for handling electronic protected health information and the platform’s marketing automation features can store and transmit data elements that constitute protected health information. HIPAA permits a regulated … Read more
Online appointment scheduling is HIPAA compliant only when the scheduling system and any related reminder or messaging functions protect electronic protected health information under the HIPAA Security Rule, scheduling workflows limit uses and disclosures under the HIPAA Privacy Rule and the HIPAA Minimum Necessary Rule, and the scheduling vendor and its subcontractors will sign a … Read more
You can know your email is HIPAA compliant when your organization can document that emails containing protected health information are sent for a permitted purpose under the HIPAA Privacy Rule, the content is limited under the HIPAA Minimum Necessary Rule when it applies, the email environment meets HIPAA Security Rule safeguard requirements for electronic protected … Read more
HIPAA data retention requirements mandate that HIPAA Covered Entities and Business Associates retain required HIPAA documentation for six years from the date of creation or the date it last was in effect, while medical record retention periods are primarily governed by state law and other federal requirements rather than HIPAA. The six year retention requirement … Read more
Claims submission and clearinghouse tools are HIPAA compliant when their use, configuration, and vendor obligations support permitted claims processing activities and meet applicable requirements under the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule, including execution of a HIPAA Business Associate Agreement when the vendor creates, receives, maintains, or transmits protected health … Read more
Skype can only be used in a HIPAA-compliant manner for electronic protected health information when the use is limited to Skype for Business that is covered by a Microsoft Business Associate Agreement under a qualifying Microsoft 365 or Office 365 business plan, and when the service is configured to meet HIPAA Security Rule requirements for … Read more
The U.S. Government Accountability Office wrote to Health and Human Services Chief Information Officer (CIO) Clark Minor, calling his attention about the recommendations for the present open cybersecurity and IT management. As a non-partisan agency, GAO works for Congress and gives assistance to ensure it fulfills its constitutional duties and helps enhance the efficiency and … Read more
Mobile device management (MDM) supports HIPAA compliance when it is implemented as part of an organization’s HIPAA Security Rule safeguards for mobile devices that create, receive, maintain, or transmit electronic protected health information, and when any MDM vendor that handles electronic protected health information on behalf of a HIPAA Covered Entity or Business Associate signs … Read more
Mad Mimi is not HIPAA compliant for uses that involve protected health information because it does not offer a Business Associate Agreement for HIPAA Covered Entities or Business Associates, so it should not be used to create, receive, maintain, or transmit protected health information through email campaigns, subscriber management, or related email marketing functions. A … Read more
HIPAA training in dermatology must satisfy the workforce training obligations in the HIPAA Privacy Rule and the security awareness program requirements in the HIPAA Security Rule, with content adapted to clinical photography, teledermatology, imaging workflows, and vendor participation in handling protected health information. The HIPAA Journal has the best choice of HIPAA training for dematology … Read more
The U.S. Department of Justice arrested Volodymyr Viktorovich Tymoshchuk who is accused of his important role in several ransomware operations. This Ukrainian ransomware criminal, also known as Boba, deadforz, msfv, and farnetwork, is alleged to have conducted the MegaCortex, Nefilim, and LockerGaga ransomware operations from December 2018 to October 2021. Tymoshchuk, with his accomplices, performed … Read more
Microsoft Publisher can be used in a HIPAA-compliant manner only when it is deployed under a qualifying Microsoft 365 or Office 365 business subscription that is covered by Microsoft’s HIPAA Business Associate Agreement for in-scope services, configured to meet HIPAA Security Rule safeguards, and governed by HIPAA Privacy Rule and HIPAA Minimum Necessary Rule controls … Read more
Patient confidentiality can be broken only when the patient provides a valid HIPAA authorization or when a disclosure of protected health information is permitted or required by the HIPAA Privacy Rule or other applicable law, including disclosures for treatment, payment, and health care operations, disclosures to the individual, and limited public interest disclosures such as … Read more
Video conferencing is HIPAA compliant when a HIPAA Covered Entity or Business Associate uses the service for a permitted purpose under the HIPAA Privacy Rule, protects electronic protected health information with safeguards required by the HIPAA Security Rule, and has a Business Associate Agreement in place when the video conferencing provider creates, receives, maintains, or … Read more
Eligibility verification software is HIPAA compliant only when the software and its supporting services protect electronic protected health information under the HIPAA Security Rule, eligibility workflows limit uses and disclosures under the HIPAA Privacy Rule and the HIPAA Minimum Necessary Rule, and the vendor and any connected service providers that create, receive, maintain, or transmit … Read more
MailerLite is not HIPAA compliant for HIPAA Covered Entities or Business Associates because it does not offer a Business Associate Agreement and its service is not presented as supporting HIPAA Privacy Rule and HIPAA Security Rule requirements for creating, receiving, maintaining, or transmitting electronic protected health information. HIPAA requires a written contract, commonly a Business … Read more
HIPAA password requirements mean HIPAA Covered Entities and Business Associates must implement policies, procedures, and technical controls that provide unique user identification, authenticate users, and protect access to electronic protected health information, using password management practices that are reasonable and appropriate to the organization’s risk analysis under the HIPAA Security Rule. The HIPAA Security Rule … Read more
Healthcare entities are less likely to have critical cybersecurity vulnerabilities as opposed to other industries, since they are typically good at prevention; nevertheless, when vulnerabilities are discovered, healthcare falls behind other industries in terms of remediation. These are the conclusions of a recent research about penetration testing data and a survey by the Pentest-as-a-service (PTaaS) … Read more
Healthcare providers secure electronic media and devices with electronic protected health information by implementing HIPAA Security Rule administrative, physical, and technical safeguards that control access, encrypt and protect stored and transmitted data, manage device and media movement through documented procedures, and monitor and respond to security incidents. Device and media controls start with inventory and … Read more
Healthcare organizations should use cloud computing when the cloud service is treated as a regulated function under HIPAA and the organization executes a Business Associate Agreement, completes a documented HIPAA Security Rule risk analysis for the cloud use case, implements required administrative, physical, and technical safeguards, and verifies that the cloud service provider’s responsibilities and … Read more
HIPAA violations are reported by documenting the facts, notifying the appropriate internal privacy or security officials, following the organization’s incident response and breach assessment procedures, and when applicable submitting a complaint to the Office for Civil Rights at the Department of Health and Human Services or reporting a breach through the required HHS breach reporting … Read more
Indicative is not HIPAA compliant for HIPAA Covered Entities or Business Associates because Indicative does not sign a HIPAA Business Associate Agreement and therefore cannot be used to create, receive, maintain, or transmit electronic protected health information on behalf of a regulated healthcare organization. HIPAA requires a written HIPAA Business Associate Agreement when a vendor … Read more
Windows 10 can be used in a HIPAA-compliant manner only when it is deployed and managed under a HIPAA Security Rule program that enforces administrative, physical, and technical safeguards for endpoints that create, receive, maintain, or transmit electronic protected health information, and its continued use after Microsoft ends standard support on October 14, 2025 requires … Read more
Practice management software is HIPAA compliant only when the software and its supporting services can be configured to meet the administrative, physical, and technical safeguard requirements of the HIPAA Security Rule, the organization uses the software in a way that limits uses and disclosures under the HIPAA Privacy Rule and the HIPAA Minimum Necessary Rule, … Read more
Antivirus tools are not HIPAA compliant by product label, but they can support HIPAA compliance when deployed and managed under documented HIPAA Security Rule safeguards for guarding against, detecting, and reporting malicious software, and when the vendor will sign a HIPAA Business Associate agreement for any service arrangement that involves the vendor creating, receiving, maintaining, … Read more
Electronic consent management is HIPAA compliant when the consent workflow and technology protect electronic protected health information under the HIPAA Security Rule, support valid written authorizations under the HIPAA Privacy Rule where required, apply the HIPAA Minimum Necessary Rule to consent related access and disclosures, and the consent management provider will sign a HIPAA Business … Read more
Recent alerts had been issued concerning a critical vulnerability identified in FortiSIEM with a publicly available exploit code and two vulnerabilities in N-able N-central. Network defenders use FortiSIEM, a central security information and event management (SIEM) solution, for network telemetry, logging, and security incident notifications. Big companies, healthcare organizations, and government entities commonly use FortiSIEM. … Read more
A HIPAA release form is required only when a HIPAA Covered Entity or Business Associate plans to use or disclose protected health information for a purpose that is not otherwise permitted or required by the HIPAA Privacy Rule and the disclosure cannot be supported by another HIPAA Privacy Rule permission pathway. A HIPAA release form … Read more
The HIPAA Breach Notification Rule is the federal HIPAA requirement that obligates HIPAA Covered Entities and, in defined circumstances, Business Associates to provide written notifications after the discovery of a breach of unsecured protected health information, including notice to affected individuals, notice to the Secretary of the U.S. Department of Health and Human Services, and … Read more
Kidney dialysis service provider, DaVita, in Denver, CO, submitted a data breach report to the HHS’ Office for Civil Rights due to a ransomware attack on April 12, 2025. The attackers acquired access to its system, exfiltrated sensitive information, and encrypted files on some of its systems. Although the attack temporarily disrupted part of its … Read more
Responding to a HIPAA violation requires immediate containment of any improper access, use, or disclosure of protected health information, a documented investigation and risk assessment to determine whether a breach of unsecured protected health information occurred, timely notifications when required under the HIPAA Breach Notification Rule, corrective action to address root causes, workforce accountability measures, … Read more
The HIPAA regulations characterize a deliberate violation as willful neglect, defined as a conscious, intentional failure or reckless indifference to the obligation to comply with an Administrative Simplification provision. Willful neglect is used in the enforcement framework for civil money penalties and is distinct from violations caused by lack of knowledge or reasonable cause. When … Read more
An employee can be fired for an accidental HIPAA violation when the employer’s sanction policy and applicable employment terms allow termination for the conduct, because the HIPAA Privacy Rule and HIPAA Security Rule require regulated entities to apply appropriate workforce sanctions for noncompliance but do not mandate termination as the sole outcome. HIPAA covered entities … Read more
Common HIPAA violations on social media include workforce members posting or discussing protected health information without a valid HIPAA-permitted basis, patient authorization, or appropriate safeguards, such as sharing patient images or videos, identifying details, clinical narratives tied to an individual, screenshots of records, or responses that confirm a person’s status as a patient. A frequent … Read more
Group chats are HIPAA compliant only when the chat is implemented as an approved communication system that meets HIPAA Security Rule safeguard requirements, limits access to authorized participants, supports HIPAA Privacy Rule use and disclosure controls including the HIPAA Minimum Necessary Rule, and is covered by a HIPAA compliant business associate agreement with the vendor … Read more
Protected health information is individually identifiable health information that is created, received, maintained, or transmitted by a HIPAA Covered Entity or Business Associate in any form or medium, that relates to an individual’s past, present, or future physical or mental health or condition, the provision of health care to the individual, or the past, present, … Read more
A District Court judge recently approved a settlement of a consolidated class action complaint for $8.5 million against Nuance Communications in association with a data breach in May 2023. This computer software firm, based in Burlington, Massachusetts, is owned by Microsoft. HIPAA business associate, Nuance Communications, offers speech recognition programs to clients in the healthcare … Read more
An incidental disclosure of protected health information is a secondary and unintended exposure that occurs as a byproduct of an otherwise permitted use or disclosure under the HIPAA Privacy Rule and that is not a HIPAA violation when the HIPAA Covered Entity or Business Associate applies reasonable safeguards and follows the HIPAA Minimum Necessary Rule … Read more
HIPAA applies to spouses only when a spouse is acting in a role that makes them part of a HIPAA Covered Entity’s or Business Associate’s workforce or operations, while a spouse who is a private individual is not regulated by HIPAA but may receive or be denied access to a partner’s protected health information based … Read more
Microsoft and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have released alerts regarding a high-severity vulnerability impacting Exchange hybrid deployments that can enable an attacker to elevate privileges in Exchange Online cloud settings without being detected, potentially compromising the identity integrity of a company’s Exchange Online service. Vulnerability CVE-2025-53786 affects hybrid-joined settings of Exchange … Read more
Zapier is not HIPAA compliant and cannot be used by a HIPAA Covered Entity, Business Associate, or subcontractor to create, receive, maintain, transmit, or store Protected Health Information because Zapier does not sign Business Associate Agreements and its automation model relies on connected applications and sub-processors that do not support HIPAA compliance. Zapier is a … Read more
Patient survey tools are not HIPAA compliant by product label, but they can be used in a HIPAA-compliant manner when the survey workflow is designed to limit protected health information collection to the HIPAA Minimum Necessary Rule, the tool and all connected services operate with HIPAA Security Rule safeguards, and the vendor signs a HIPAA … Read more
The 2025 Cost of a Data Breach Report by IBM reveals a drop in the worldwide average data breach cost. However, the cost of U.S. data breaches increased by 9.2% to $10.22 million. It was $9.36 million in 2024. The increased costs of U.S. data breaches were mostly because of higher regulatory penalties. and detection … Read more
Amwell can be used in a HIPAA compliant manner when a HIPAA Covered Entity or Business Associate signs a HIPAA Business Associate agreement with Amwell for the applicable services, configures the platform to support required safeguards, and operates telemedicine workflows in a way that prevents impermissible uses or disclosures of protected health information under the … Read more
Clinical dictation software is not HIPAA compliant by product label, but it can be used in a HIPAA-compliant manner when the dictation workflow meets HIPAA Privacy Rule and HIPAA Security Rule requirements for protected health information and the vendor signs a HIPAA Business Associate agreement for any service in which the vendor creates, receives, maintains, … Read more
Sending a patient account to a debt collection agency is not a HIPAA violation when the disclosure is permitted for payment under the HIPAA Privacy Rule, limited to information that supports the collection activity under the HIPAA Minimum Necessary Rule, and governed by a compliant vendor relationship and safeguards when a business associate is involved. … Read more
Misunderstandings about what information is protected by HIPAA can result in operational inefficiencies or impermissible uses and disclosures of PHI. Misunderstanding about what information is protected by HIPAA are often attributable to a lack of understanding about what Protected Health Information is. According to the definitions section of the Administrative Simplification Provisions (§160.103), Protected Health … Read more
An international law enforcement operation succeeded in seizing the dark web sites of the BlackSuit ransomware group. The takedown covers BlackSuit’s negotiation and data leak websites, after a court order approved the seizure. The dark websites now display banners informing visitors that U.S. Homeland Security Investigations has seized the web properties as part of Operation … Read more
HIPAA does not apply to animals because the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule protect individually identifiable health information about human individuals, not veterinary records or information about an animal’s health. Protected health information under HIPAA is health information that identifies or can identify a person and relates to that … Read more
Patient payment portals are HIPAA compliant when the portal handles protected health information only for permitted payment activities, applies administrative, physical, and technical safeguards that meet the HIPAA Security Rule, limits uses and disclosures under the HIPAA Privacy Rule, supports incident response and notification obligations under the HIPAA Breach Notification Rule, and the vendor signs … Read more
A phishing attack impacted several cancer care organizations of the Integrated Oncology Network (ION). All impacted entities released identical breach notices concerning the attack. According to the breach notices, the sophisticated phishing attack allowed unauthorized individuals to access a few employee email and SharePoint accounts. ION took immediate action to protect the impacted accounts and … Read more
Website chat can be used in a HIPAA-compliant manner only when the chat function is configured and governed to prevent impermissible disclosures of protected health information, the vendor signs a HIPAA Business Associate agreement when the service creates, receives, maintains, or transmits protected health information on the organization’s behalf, and the implementation meets HIPAA Security … Read more
There is a new ransomware group that is attacking several industries, particularly technology, healthcare, and event services. Based on the latest Trend Micro report, the Bert ransomware group, tracked as Water Pombero, first attacked entities in the United States and Asia, though victims across Europe were also identified. It is believed to have originated from … Read more
Healthcare compliance is the structured process by which a healthcare organization establishes, implements, and documents policies, controls, training, monitoring, and corrective actions to meet applicable legal, regulatory, contractual, and ethical requirements that govern patient care, billing, privacy, security, workplace conduct, and organizational governance. Healthcare compliance programs typically address federal and state requirements that apply to … Read more
Intercom can be HIPAA compliant for electronic Protected Health Information when an organization subscribes to the Expert business plan, signs Intercom’s Business Associate Agreement before any use with electronic Protected Health Information, configures the platform to support HIPAA compliance, and trains workforce members on compliant use. Intercom is a customer service and engagement platform that … Read more
Document management software is HIPAA compliant when it is used to create, receive, maintain, or transmit protected health information only under permitted HIPAA Privacy Rule purposes, it is implemented with administrative, physical, and technical safeguards that meet the HIPAA Security Rule, it supports breach assessment and notification obligations under the HIPAA Breach Notification Rule, and … Read more
PHI stands for protected health information, meaning individually identifiable health information that is created or received by a HIPAA Covered Entity or Business Associate and that relates to an individual’s past, present, or future physical or mental health or condition, the provision of health care to the individual, or payment for health care, and that … Read more
WhatsApp is not HIPAA compliant and should not be used by a HIPAA Covered Entity or Business Associate to receive, store, or send Protected Health Information, except when a patient initiates contact through WhatsApp or requests confidential communications through that specific channel and the provider documents the request and applies reasonable safeguards. Electronic communications that … Read more
ActiveCampaign is not HIPAA compliant for handling electronic protected health information in email marketing workflows because HIPAA compliance requires a signed HIPAA Business Associate Agreement that covers the specific services in scope and operational controls that prevent electronic protected health information from being created, received, maintained, or transmitted in ways the platform is not designed … Read more
HIPAA compliance is the documented and continuously maintained set of administrative, physical, and technical controls that a HIPAA Covered Entity or Business Associate uses to meet requirements of the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule for protecting protected health information, limiting uses and disclosures, and responding to impermissible uses or … Read more
Michigan-based McLaren Health Care began informing 743,131 individuals about the compromise of some of their protected health information (PHI) during a ransomware attack in August 2024. McLaren Health Care had earlier reported the ransomware attack, but the analysis of the compromised files took a longer time; therefore, the delay in sending personal breach notification letters. … Read more
WebEngage is not HIPAA compliant for HIPAA Covered Entities or Business Associates because WebEngage does not offer a HIPAA Business Associate Agreement for its platform, which prevents regulated organizations from using it to create, receive, maintain, or transmit electronic protected health information. HIPAA requires a written HIPAA Business Associate Agreement when a vendor performs services … Read more
After a HIPAA complaint is filed, the receiving office records the complaint, evaluates whether the allegations fall under the HIPAA Privacy Rule, HIPAA Security Rule, or HIPAA Breach Notification Rule, determines whether it has jurisdiction and sufficient information to proceed, and then either conducts an internal investigation and corrective action process within the covered entity … Read more
HIPAA was created by the United States Congress when it passed the Health Insurance Portability and Accountability Act of 1996, and the law took effect when President Bill Clinton signed it on August 21, 1996, with the statute directing the U.S. Department of Health and Human Services to implement national standards for administrative simplification that … Read more
Validic can be HIPAA compliant when a HIPAA Covered Entity or Business Associate signs a HIPAA Business Associate Agreement with Validic for the applicable services and then configures, governs, and uses the platform so electronic protected health information is handled under HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule requirements. HIPAA compliance … Read more
HIPAA training requirements are defined by the HIPAA Privacy Rule and the HIPAA Security Rule and require HIPAA Covered Entities to train workforce members on the policies and procedures implemented to comply with those rules, to provide training that is necessary and appropriate for each workforce member’s functions, to train new workforce members within a … Read more
Two-way patient messaging is HIPAA compliant when the messaging workflow is limited to permitted treatment, payment, and healthcare operations uses, protected health information is safeguarded under the HIPAA Security Rule, uses and disclosures are controlled under the HIPAA Privacy Rule, breach response procedures support the HIPAA Breach Notification Rule, and any vendor that creates, receives, … Read more
Ransomware continues to present a considerable threat to U.S. healthcare providers, though many ransomware groups no longer encrypt data and only conduct extortion attacks. Cybersecurity company Sophos’ new report shows that only 50% of ransomware attacks in 2025 included file encryption. The threat of exposing stolen information is usually enough to compel victims to give … Read more
Self-attestation does not work as the primary method for HIPAA training because it documents acknowledgement without demonstrating comprehension, produces low retention, provides limited defensible evidence of workforce readiness during an Office for Civil Rights review, and does not support targeted remediation for recurring privacy and security failures. Self-Attestation Documents Passive Exposure to Content, Not Competence … Read more
In early June 2025, the House of Representatives and Senate introduced two bipartisan bills seeking to improve the healthcare and public health (HPH) sector cybersecurity through better coordination at the government level so that, in the event of cyberattacks on HPH sector entities, government agencies could respond immediately and efficiently. There have been significantly more … Read more
Doxy.me can be used in a HIPAA compliant manner for telehealth when the organization uses a plan that supports HIPAA requirements, executes a HIPAA Business Associate agreement with Doxy.me, and configures workflows and policies to meet the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule. HIPAA compliance for a telehealth platform depends … Read more
Twilio SendGrid is not HIPAA compliant and cannot be used to send email communications containing Protected Health Information because doing so violates HIPAA and SendGrid’s Terms of Service, but it can be used by healthcare organizations for general healthcare communications and marketing campaigns that do not include Protected Health Information. SendGrid is an email communication … Read more
Email HIPAA violations can be avoided by restricting email use of protected health information to an approved, business associate agreement covered email service, applying HIPAA Security Rule safeguards for access, transmission, devices, audit, and retention, and enforcing HIPAA Privacy Rule controls for permitted disclosures and the HIPAA Minimum Necessary Rule through documented policies, training, and … Read more
A date of birth is protected health information when it identifies an individual or can reasonably be used to identify an individual and it is linked to health information created, received, maintained, or transmitted by a HIPAA Covered Entity or Business Associate, and it is not protected health information when it is not associated with … Read more
Non-profit provider of drug and alcohol addiction services, Drug and Alcohol Treatment Services, Inc. (DATS), based in Scranton, PA, is facing multiple class action lawsuits because of a ransomware attack in October 2024. DATS discovered the unauthorized access to its computer system on October 6, 2024. Based on the forensic investigation, an unauthorized third party … Read more
Microsoft Edge is not HIPAA compliant as a standalone web browser, and it is only suitable for HIPAA regulated use when it is managed, kept supported and patched, and used to access systems that are configured for compliance under an applicable HIPAA Business Associate agreement when required. Browser choice affects HIPAA Security Rule compliance because … Read more
Hightail is not HIPAA compliant for HIPAA Covered Entities or Business Associates because Hightail will not sign a HIPAA Business Associate Agreement for handling electronic protected health information and the service is not offered as a HIPAA-eligible platform for regulated healthcare workflows. HIPAA requires a written HIPAA Business Associate Agreement when a vendor creates, receives, … Read more
Patient reminder systems are HIPAA compliant when appointment reminders are limited to permitted treatment communications, patient requested privacy restrictions and confidential communication preferences are applied to the reminder workflow, the system is configured with safeguards that meet the HIPAA Security Rule for any electronic protected health information it creates, receives, maintains, or transmits, the vendor … Read more
Paubox is HIPAA compliant as an email encryption solution and can be used by HIPAA Covered Entities and Business Associates to communicate Protected Health Information by email without violating the standards of the HIPAA Privacy Rule or HIPAA Security Rule when a Business Associate Agreement is executed and the service is configured and used to … Read more
The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have updated an earlier published joint cybersecurity alert regarding the Play ransomware group, also called Playcrypt. Playcrypt appeared in June 2022 and has executed ransomware attacks on companies in various industries, such as HIPAA-compliant healthcare organizations and other critical infrastructure entities. … Read more
GoTo can be used in a HIPAA-compliant manner when a HIPAA Covered Entity or Business Associate signs GoTo’s HIPAA Business Associate Agreement for the specific GoTo service offerings in scope and then configures and operates those services to meet HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule requirements for electronic protected health … Read more
Microsoft OneDrive can be used in a HIPAA-compliant manner when a HIPAA Covered Entity or Business Associate subscribes to a plan that supports HIPAA compliance, agrees to Microsoft’s Business Associate (Data Protection) Addendum, and configures and uses OneDrive to meet HIPAA requirements. OneDrive is a file storage service used for document sharing and collaboration. When … Read more
Microsoft PowerPoint can be used in a HIPAA-compliant manner only when it is deployed under a qualifying Microsoft 365 or Office 365 business subscription that is covered by Microsoft’s HIPAA Business Associate Agreement, configured to meet HIPAA Security Rule safeguard requirements, and governed by workforce policies that prevent impermissible uses and disclosures of protected health … Read more
HIPAA was enacted on August 21, 1996, when the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, was signed into law in the United States. The 1996 law included multiple titles that addressed health insurance portability, tax-related provisions, fraud and abuse, and administrative simplification for health care transactions. The provisions that drive … Read more
Microsoft Teams is HIPAA compliant for collecting, storing, sharing, or transmitting electronic Protected Health Information when a HIPAA Covered Entity or Business Associate subscribes to an appropriate Microsoft business plan that is covered by Microsoft’s Business Associate Agreement, configures the platform to meet the HIPAA Security Rule technical safeguard requirements, and trains the workforce to … Read more
No, not all emails are HIPAA compliant because HIPAA compliance depends on whether the message involves protected health information, whether the sender is a HIPAA Covered Entity or Business Associate, and whether required safeguards, agreements, and controls are in place for the specific email use. Many emails are outside HIPAA because they do not create, … Read more
HIPAA compliant telemedicine is the delivery of clinical services through remote communication technologies in a manner that protects protected health information under the HIPAA Privacy Rule, the HIPAA Security Rule, and the HIPAA Breach Notification Rule, including using telehealth technology with appropriate safeguards, executing required Business Associate Agreements with vendors that create, receive, maintain, or … Read more
The Cyber Division of the Federal Bureau of Investigation (FBI) has released an alert to U.S. law firms regarding targeted attacks conducted by the Silent Ransom Group. From Spring 2023, the Silent Ransom group has been constantly targeting U.S. law offices, though it also executed attacks in several industries, such as healthcare. The Silent Ransom … Read more
The purpose of HIPAA is to improve the portability and continuity of health insurance coverage, reduce fraud and abuse in health care financing and delivery, and standardize administrative health care transactions, while the HIPAA Administrative Simplification provisions also support national requirements that govern the permitted use and disclosure of protected health information, protect electronic protected … Read more
Employee benefits administrator, Kelly & Associates Insurance Group, based in Sparks, Maryland, dba Kelly Benefits, has published edited figures on the number of people impacted by a cyberattack on December 2024. On April 9, 2025, Kelly Benefits at first reported the data breach as an event related to unauthorized access to the information of 32,234 … Read more
Password managers are not “HIPAA compliant” products by designation, but they can be used in a HIPAA-compliant manner when the deployment supports HIPAA Security Rule administrative, physical, and technical safeguards, and when the vendor will sign a HIPAA Business Associate agreement for any service that creates, receives, maintains, or transmits electronic protected health information on … Read more
HoneyBook is not HIPAA compliant for creating, collecting, storing, maintaining, or transmitting electronic Protected Health Information when a healthcare provider is a HIPAA Covered Entity or is acting as a Business Associate, and it may only be used when electronic Protected Health Information is not accessible to HoneyBook’s servers or when a patient has executed … Read more
Schedulicity is not HIPAA compliant for HIPAA Covered Entities or Business Associates because Schedulicity does not sign a HIPAA Business Associate Agreement and the service is not offered as a controlled environment for creating, receiving, maintaining, or transmitting electronic protected health information. HIPAA requires a written contract when a vendor performs functions or services for … Read more
Using email to send patient names and electronic protected health information does not automatically violate HIPAA, and it becomes a HIPAA violation when the message involves an impermissible use or disclosure under the HIPAA Privacy Rule, when the safeguards required by the HIPAA Security Rule are not implemented for the email system and workflow, or … Read more
Call recording systems are HIPAA compliant when recordings and related metadata that contain protected health information are created and stored only for a defined operational purpose, safeguarded in accordance with the HIPAA Security Rule, used and disclosed in accordance with the HIPAA Privacy Rule, managed under documented retention and access controls, and supported by a … Read more
POP is not HIPAA compliant because it does not encrypt email data during transmission and lacks security features relied on to protect Protected Health Information in email workflows. POP, or Post Office Protocol, is used to retrieve email from a mail server to a local device, and it generally downloads messages to a single device … Read more
Netgain Technology has made the decision to resolve a consumer data breach lawsuit filed because of a ransomware attack and data breach in 2020. Netgain will create a $1.9 million settlement fund to pay class member claims. Netgain is a cloud hosting and managed IT service company based in Minnesota, and many of its clients … Read more
HIPAA incident response planning is the documented and tested process a HIPAA Covered Entity or Business Associate uses to detect, contain, investigate, mitigate, and document suspected or confirmed impermissible uses or disclosures of protected health information and suspected or confirmed security incidents involving electronic protected health information, including the decision steps and notification actions required … Read more
HIPAA compliant bulk email communication is the use of email to send the same or similar message to multiple recipients while preventing impermissible disclosures of protected health information, applying safeguards required by the HIPAA Privacy Rule and HIPAA Security Rule, limiting content under the HIPAA Minimum Necessary Rule when applicable, and using vendors and configurations … Read more
Telling a story about a patient can be a HIPAA violation when the story discloses protected health information without a permitted purpose under the HIPAA Privacy Rule, exceeds the HIPAA Minimum Necessary Rule when it applies, or includes enough details to identify the patient, while a story can be shared without violating HIPAA when it … Read more
Lab ordering and results portals are HIPAA compliant only when the portal and related services protect electronic protected health information under the HIPAA Security Rule, portal workflows limit uses and disclosures under the HIPAA Privacy Rule and the HIPAA Minimum Necessary Rule, and the portal provider and any connected vendors that create, receive, maintain, or … Read more
HIPAA was implemented to improve the portability and continuity of health insurance coverage, reduce administrative burden and cost through standardized electronic healthcare transactions, and establish enforceable federal safeguards and individual rights for protected health information handled by regulated healthcare organizations and their business associates. The statute addressed coverage disruptions that occurred when individuals changed jobs, … Read more
Calendly is not HIPAA compliant and cannot be used by a HIPAA Covered Entity or Business Associate to create, collect, maintain, or transmit protected health information because doing so violates Calendly’s terms of service and Calendly refuses to enter into Business Associate Agreements with covered entities and upstream business associates. Calendly is a scheduling platform … Read more
Masimo, a producer of patient monitoring devices, submitted a Form 8-K to the U.S. Securities and Exchange Commission (SEC) to notify investors concerning a cyberattack that has impacted its production facilities. Masimo stated some of its production facilities were running at under normal levels from the time of the attack, which is impacting the company’s … Read more
The six patient rights under the HIPAA Privacy Rule are the right to receive a Notice of Privacy Practices, the right to access and obtain a copy of protected health information in a designated record set, the right to request an amendment of protected health information in a designated record set, the right to receive … Read more
Windows 11 can be used in a HIPAA-compliant manner only when it is deployed and managed under a documented HIPAA Security Rule program that implements required administrative, physical, and technical safeguards for endpoints that create, receive, maintain, or transmit electronic protected health information. Windows 11 is an operating system and does not provide HIPAA compliance … Read more
A patient portal is HIPAA compliant only when the portal and its supporting services are implemented and configured to meet the safeguard requirements of the HIPAA Security Rule, portal operations comply with the use and disclosure requirements of the HIPAA Privacy Rule and the HIPAA Minimum Necessary Rule, and the portal provider and any connected … Read more
HIPAA policy management is the controlled process a HIPAA Covered Entity or Business Associate uses to develop, approve, implement, maintain, review, and retire written policies and procedures that operationalize the HIPAA Privacy Rule, HIPAA Security Rule, HIPAA Breach Notification Rule, and related administrative requirements, with defined ownership, version control, workforce communication, training alignment, documentation, and … Read more
Infusionsoft by Keap is not HIPAA compliant for HIPAA Covered Entities or Business Associates because Keap does not offer a HIPAA Business Associate Agreement for Infusionsoft by Keap and the platform is not positioned for creating, receiving, maintaining, or transmitting electronic protected health information in marketing automation workflows. HIPAA requires a written HIPAA Business Associate … Read more
The court has given final approval of a $2.4 million settlement of a class action lawsuit against Somnia Inc. in association with a cyberattack and data breach in 2022. Somnia operates anesthesiology services at over 100 surgery centers throughout the country. In 2022, Somnia encountered a cyberattack that enabled hackers to access its system that … Read more
Google Forms is HIPAA compliant only when it is used through an appropriate Google Workspace or Cloud Identity package, Google’s Business Associate Addendum is signed, the service is configured to meet the HIPAA Security Rule technical safeguard requirements, and workforce members are trained to use Google Forms in a compliant manner. Google Forms does not … Read more
Workplace gossip is a HIPAA violation when workforce members of a HIPAA Covered Entity or Business Associate disclose or use protected health information without a permitted HIPAA Privacy Rule purpose, without a valid authorization, or beyond what their role requires under the HIPAA Minimum Necessary Rule, and it is not a HIPAA violation when the … Read more
It is not necessary for Zelle to be HIPAA compliant for a healthcare organization to accept patient-initiated payments because payment processing by financial institutions and related payment networks is generally outside the HIPAA Administrative Simplification Regulations, but the covered entity or business associate using Zelle remains responsible for preventing protected health information from being transmitted … Read more
Healthcare organizations mitigate insider threats by combining HIPAA Security Rule administrative, physical, and technical safeguards with workforce governance that limits access to electronic protected health information, monitors user activity, enforces sanctions, and responds to suspicious behavior through documented incident response procedures. Insider threats include misuse of access by workforce members, contractors, or trusted partners, whether … Read more
The advantages of HIPAA include enforceable federal standards for protecting the privacy and security of protected health information, uniform patient rights over health information, and a defined framework for breach response and accountability, while the disadvantages include administrative and documentation burden, compliance costs, operational friction in care coordination and data sharing, and enforcement exposure from … Read more
A malware campaign using ResolverRAT is targeting healthcare companies and pharmaceutical firms. ResolverRAT is a new stealthy remote access trojan that is being downloaded through phishing emails pretending to be notifications about copyright violations or other legalities that can cause a false impression of urgency. The phishing emails contain a web link that redirects the … Read more
Clinical transcription software is not HIPAA compliant by product label, but it can be used in a HIPAA-compliant manner when the transcription workflow meets HIPAA Privacy Rule and HIPAA Security Rule requirements for protected health information handling and the vendor signs a HIPAA Business Associate agreement for any arrangement in which the vendor creates, receives, … Read more
Whether or not you should decline a HIPAA authorization request is event specific and can depend on the purpose of the HIPAA authorization request, the content of the authorization form, and the amount of information you have been given about who your information will be shared with. If you do not have sufficient information to … Read more
HIPAA does not apply to individuals acting in a personal capacity, most employers and employment records, most schools and education records covered by federal education privacy law, most life insurers, most workers’ compensation carriers and programs when operating under workers’ compensation authority, and most businesses and apps that collect health-related data but are not HIPAA … Read more
Calling an emergency contact is not a HIPAA violation when a HIPAA Covered Entity or Business Associate limits the disclosure to what is permitted under the HIPAA Privacy Rule, uses professional judgment based on the patient’s circumstances, and shares only the protected health information needed for the specific purpose of notification or care coordination. A … Read more
Healthcare providers should respond to a HIPAA incident by promptly containing the event, preserving evidence, assessing whether protected health information was impermissibly used or disclosed, applying the HIPAA Breach Notification Rule risk assessment where applicable, completing any required notifications within required timeframes, and implementing corrective actions documented under the HIPAA Privacy Rule and HIPAA Security … Read more
Workday can be used in a HIPAA-compliant manner when a HIPAA Covered Entity or Business Associate executes Workday’s HIPAA Business Associate Agreement for the specific Workday services that will handle electronic protected health information and then configures and governs the environment to meet HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule requirements. … Read more
WordPress is not HIPAA compliant by default and WordPress will not sign a business associate agreement, but a WordPress website can be configured to support HIPAA-compliant collection and transmission of electronic protected health information when HIPAA Security Rule safeguards are implemented, electronic protected health information is secured outside WordPress, the site is hosted with a … Read more
DaVita had an 8K filing with the U.S. Securities and Exchange Commission (SEC) on April 14, 2025. Based on the information submitted, the kidney dialysis provider suffered a ransomware attack that led to the encryption of portions of its system. The attack happened on April 12, 2025 and affected a number of its operations. In … Read more
Common types of HIPAA violations by nurses include impermissible access to patient records without a treatment or operations need, unauthorized disclosures of protected health information in verbal, written, or electronic form, and failures to apply required safeguards that expose protected health information to persons who are not authorized to receive it. Improper access occurs when … Read more
HIPAA applies to community outreach initiatives when a HIPAA Covered Entity or its Business Associate creates, uses, discloses, maintains, or transmits protected health information as part of the outreach activity, and it does not apply to outreach conducted by organizations outside those roles unless they receive protected health information on behalf of a covered entity … Read more
Microsoft Access can support HIPAA-compliant use of electronic protected health information only when it is deployed within a controlled environment that meets HIPAA Security Rule safeguard requirements, uses a HIPAA Business Associate Agreement for any Microsoft-hosted services involved in storing or transmitting the data, and is governed by HIPAA Privacy Rule and HIPAA Minimum Necessary … Read more
HIPAA applies to dental records when the dental practice is a HIPAA Covered Entity that conducts HIPAA standard transactions electronically, or when a vendor or service provider handles dental records as a Business Associate for a HIPAA Covered Entity or Business Associate, because dental charts, clinical notes, diagnostic images, periodontal measurements, treatment plans, billing records, … Read more
Microsoft has fixed a vulnerability identified in the Windows Common Log File System (CLFS). A threat actor known as Storm-2460 is actively exploiting the vulnerability using PipeMagic malware. The attacker uses the malware to exploit the vulnerability to alter privileges to spread the ransomware in the victim’s network. Windows CLFS is a recording system for … Read more
HIPAA compliance can be placed on a resume by documenting completed role relevant HIPAA training and experience in handling protected health information, listing a completed HIPAA certification course from a reputable training provider with recognized credibility, and describing specific compliance tasks performed under the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule … Read more
HIPAA was signed into law on August 21, 1996, when President Bill Clinton signed the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191. The date HIPAA became law is separate from the dates when the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule became enforceable requirements for regulated entities. … Read more
Evernote is not HIPAA compliant and cannot be used by a HIPAA Covered Entity or Business Associate to save, store, sync, or share documents, images, or notes containing protected health information because the platform lacks controls required for compliance with the HIPAA Privacy Rule and the HIPAA Security Rule and Evernote will not enter into … Read more
Getting HIPAA certified through an online HIPAA training course typically takes 60 to 90 minutes to complete the assigned modules and pass the required knowledge checks, and the credential is most useful when paired with annual HIPAA training as an industry best practice for any staff member who has contact with protected health information. HIPAA … Read more
Google Keep is HIPAA compliant for creating and sharing notes that contain electronic protected health information when a HIPAA Covered Entity or Business Associate subscribes to a Google Workspace plan that supports HIPAA compliance, reviews and accepts Google’s Business Associate Addendum to the Workspace Service Agreement, and configures Google Drive settings and operational controls to … Read more
Therapy notes must be HIPAA compliant when they contain protected health information and are created, received, maintained, or transmitted by a HIPAA Covered Entity or Business Associate, with a separate category called psychotherapy notes subject to stricter HIPAA Privacy Rule controls and distinct handling under the HIPAA Security Rule when maintained electronically as electronic protected … Read more
Return Path is not HIPAA compliant because the service, now integrated into Validity as part of the Everest email deliverability platform, does not sign a Business Associate Agreement and therefore cannot be used by a HIPAA Covered Entity or Business Associate to create, receive, maintain, or transmit protected health information. Return Path is described as … Read more
Spark DSO, LLC and CDHA Management, LLC, also known as Chord Specialty Dental Partners, recently informed the U.S. Department of Health and Human Services’ Office for Civil Rights about encountering a data breach where unauthorized access affected the protected health information (PHI) of up to 173,430 people. The dental service organization based in Tennessee offers … Read more
Uber Health is HIPAA compliant for HIPAA Covered Entities and for workforce members acting on behalf of a HIPAA Covered Entity when the organization agrees to the terms of Uber Health’s Business Associate Addendum, because Uber Health applies privacy and security controls to data entered in the dashboard and limits what is shared with drivers … Read more
Ademero can support HIPAA compliance when a healthcare organization uses Content Central in alignment with the HIPAA Security Rule and executes a Business Associate Agreement with Ademero when the service involves the creation, receipt, maintenance, or transmission of Protected Health Information on the organization’s behalf. Content Central by Ademero is a cloud-based document management system … Read more
Microsoft Outlook can support HIPAA compliance for sending and receiving electronic Protected Health Information when it is used under an Office 365 or Microsoft 365 enterprise plan that supports HIPAA compliance, a Business Associate Agreement applies to the subscription, the environment is configured for compliant email use, and the workforce uses Outlook in compliance with … Read more
HIPAA encryption requirements mean that when electronic protected health information is stored or transmitted, a HIPAA Covered Entity or Business Associate must implement encryption when it is reasonable and appropriate based on its risk analysis, or implement an equivalent alternative measure and document the decision, because the HIPAA Security Rule lists encryption and decryption and … Read more
At the beginning of March 2025, Microsoft gave an update about its Cybersecurity for Rural Hospitals Program. This program is created to safeguard access to medical care for the 46 million people in rural communities by assisting rural hospitals to enhance cybersecurity. Patients from rural communities must travel twice as far as urban residents to … Read more
The HIPAA Electronic Signature Rule is not a standalone HIPAA regulation, and HIPAA permits electronic signatures for HIPAA-required documentation such as HIPAA Privacy Rule authorizations and other signed records when the electronic signature is valid under applicable law and the covered entity or business associate applies administrative, physical, and technical safeguards that preserve the confidentiality, … Read more
Google Slides can be used in a HIPAA-compliant manner to create, store, and share presentations containing Protected Health Information when it is used under a Google Workspace plan covered by a Business Associate Addendum, the environment is configured to restrict document sharing, and workforce members are trained to prevent Protected Health Information from being used … Read more
HIPAA refresher training is a recurring online HIPAA training process that reinforces required privacy, security, and breach response practices under the HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule, with annual HIPAA training serving as an industry best practice for any staff member who has contact with protected health information and with … Read more
The Health Information Sharing and Analysis Center (Health-ISAC) and the American Hospital Association (AHA) released a joint advisory cautioning hospitals regarding a possible coordinated multi-city terrorist attack targeting hospitals in the upcoming weeks. On March 18, 2025, the AHA and Health-ISAC found a social media write-up regarding possible ISIS-K coordinated terrorist attacks on U.S. hospitals. … Read more