Blog
What Is a HIPAA Violation?
When Would Our Organization Be Investigated? Quick answer: A HIPAA violation is any failure by a covered entity or business associate to comply with the HIPAA Privacy, Security, or Breach Notification Rules. It does not require a hacker or a headline; failing to provide a
MIPS Security Risk Analysis 2026: The New Risk Management Attestation
Your 2026 MIPS Attestation Now Covers Risk Management, Not Just Risk Analysis Did you know CMS requires a security risk analysis for MIPS? Under the Promoting Interoperability (PI) performance category, clinicians must attest that they conducted or reviewed a security risk analysis as required by
OCR and ONC Just Updated the Free SRA Tool; Here’s Why That Doesn’t Solve Your Risk Analysis Problem
Quick answer: On September 10, 2026, OCR and ONC released version 3.7 of the Security Risk Assessment (SRA) Tool, adding new content on remote access, telework, and system activity logging, as well as expanded asset examples and revised reports. The update is genuinely useful, but
What OCR Told Us at the 2026 HIPAA Security Conference: Enforcement, Risk Analysis, and Policy Gaps
Quick answer: At the OCR/NIST “Safeguarding Health Information” conference held September 2 to 3, 2026, in Gaithersburg, Maryland, HHS’s Office for Civil Rights delivered a consistent message across sessions: enforcement is not slowing down; risk analyses remain the most commonly cited deficiency because they are
Why Syncing Data to the Cloud Isn’t a Valid HIPAA Ransomware Strategy
If your practice or business relies on continuous cloud sync or daily cloud snapshots as your primary disaster recovery strategy, your ePHI is far more vulnerable than you think. Modern malware doesn’t just encrypt local workstations; it actively targets connected network drives, mapped cloud folders,
Does Having an MSP Mean Your Practice Is HIPAA Compliant? Not on Its Own
Quick answer: No, and this is one of the most common and most understandable misconceptions in healthcare compliance. A skilled managed service provider, or MSP, can lock down your network, patch your systems, and manage backups better than most practices could on their own; if
