logo
Contact Us

844-740-7100

    Colington Consulting

    Helping Organizations Achieve HIPAA Compliance™

    Contact Us

    Author: Colington Consulting

    • Is the New HIPAA Security Rule Final Yet?

      Is the New HIPAA Security Rule Final Yet? What Covered Entities Need to Know Right Now

      Quick answer: No. As of mid-2026, the proposed HIPAA Security Rule overhaul is still just that — proposed. OCR has not issued a final rule, its informal May 2026 target came and went with nothing published, and a coalition of more than 100 hospital and provider groups has formally asked HHS to withdraw the rule altogether. That said, organizations shouldn’t treat “not final” as “not urgent” as HIPAA’s civil penalty tiers already increased this year under current law, and history shows compliance windows shrink fast once a final rule does land.

      What the Proposed Rule Would Actually Change

      The HIPAA Security Rule hasn’t seen a substantive update since 2013. The Notice of Proposed Rulemaking published in January 2025 would be the most significant rewrite in the rule’s history, and the headline change is structural: it eliminates the long-standing distinction between “addressable” and “required” safeguards. Today, organizations can implement reasonable alternatives to certain controls and document why. Under the proposal, that flexibility disappears — nearly every safeguard becomes mandatory.

      In practice, that means encryption of electronic PHI at rest and in transit with no documented-alternative exception, multi-factor authentication required for any system that touches ePHI, network segmentation written explicitly into the technical safeguards, and a shift from occasional testing to recurring, scheduled technical assessments such as penetration testing. Business associates would also face tighter, faster incident-reporting obligations to the covered entities they serve.

      Where Things Actually Stand

      OCR’s own regulatory agenda pointed to a May 2026 finalization, but that window has passed without action. Pushback has been significant: HHS’s own regulatory impact analysis estimated roughly $9 billion in first-year industry compliance costs, climbing toward $34 billion over five years, and that price tag is a big part of why provider groups are lobbying for withdrawal rather than finalization. There’s no confirmed new timeline. If and when a final rule does publish, the expected compliance runway is short — roughly 60 days until the rule takes effect, then another 180 days to come into full compliance.

      The Part That’s Already Real: Penalties Went Up

      Separately from the Security Rule fight, OCR’s civil monetary penalty tiers received their routine annual inflation adjustment effective January 28, 2026. The top tier — willful neglect that goes uncorrected — now caps at $2,190,294 per calendar-year violation category, with the other tiers adjusted upward as well. This is current law today, independent of whatever happens with the proposed overhaul.

      What to Do Now, Regardless of the Final Rule’s Fate

      The organizations best positioned aren’t waiting for a final rule to start the clock. Encrypting ePHI everywhere, rolling out MFA, segmenting networks, and testing on a schedule are good security practice today and lower your real exposure under the penalty structure that already exists. A practical starting point: refresh your documented risk analysis, confirm your business associate agreements already require prompt breach notification language, and budget for these controls now rather than scrambling on a 240-day deadline later.

      Frequently Asked Questions

      Has the HIPAA Security Rule update been finalized? No. As of mid-2026 it remains a proposed rule with no confirmed finalization date.

      Will MFA become mandatory under HIPAA? Under the proposed rule, yes — for any system accessing ePHI. It isn’t legally required yet, though many auditors already treat it as a baseline expectation.

      How long would organizations get to comply once it’s final? Industry estimates point to about 240 days total: roughly 60 days until the rule takes effect, then 180 more days to reach full compliance.

      Did HIPAA penalties increase in 2026? Yes. The annual inflation adjustment took effect January 28, 2026, raising the maximum penalty tier.

      At Colington Consulting, we specialize in helping healthcare organizations and business associates build proactive compliance programs. Contact us at 844-740-7100 or schedule a free 30-minute HIPAA risk review to evaluate your current policies and protect your organization.

      Reviewed on June 18, 2026, By: Jay Hodes, President – Colington Consulting, HIPAA Compliance Expert

      Sources:

      • U.S. Department of Health and Human Services, Office for Civil Rights. “HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information,” Notice of Proposed Rulemaking, 90 Fed. Reg. 898 (Jan. 6, 2025). federalregister.gov
      • HHS.gov, “HIPAA Security Rule NPRM” overview page. hhs.gov
      • HHS.gov, Fact Sheet on the HIPAA Security Rule NPRM. hhs.gov
      • U.S Department of Health and Human Services, “Annual Civil Monetary Penalties Inflation Adjustment,” Fed. Reg. (Jan. 28, 2026). federalregister.gov
      • HHS.gov, “Summary of the HIPAA Security Rule” (current rule in effect). hhs.gov

      Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal advice or an official regulatory determination. For specific guidance regarding your organization’s unique operational workflows, consult directly with a HIPAA compliance specialist or legal counsel.

    • When Are NEMT Organizations HIPAA Business Associates?

      Non-Emergency Medical Transportation (NEMT) providers serve a critical role in helping patients access healthcare services. However, one of the most common compliance questions in the industry is straightforward: When is a NEMT organization considered a HIPAA Business Associate?

      For most providers, the answer is simpler than expected—yet often misunderstood.

      Understanding the Business Associate Role

      A HIPAA Business Associate (BA) is any organization that creates, receives, maintains, or transmits Protected Health Information (PHI) on behalf of a covered entity, such as a healthcare provider, health plan, or managed care organization.

      PHI includes identifiable information connected to healthcare services. In the NEMT context, that often looks like patient names tied to medical appointments, transportation arranged for treatment, Medicaid identifiers, or trip data linked to healthcare delivery.

      If your operations involve this type of information, even at a basic level, HIPAA likely applies.

      How NEMT Providers Become Business Associates

      In most healthcare transportation models, NEMT organizations are functioning as an extension of the healthcare system. This is particularly true in Medicaid and broker-driven environments, where transportation is a defined benefit tied to care.

      When trip requests are received from a broker, hospital, dialysis center, or health plan, they almost always include information that connects an individual to medical services. That connection is what transforms routine transportation data into PHI.

      Dispatch teams, drivers, and administrative staff all interact with this information in some form—whether scheduling rides, confirming appointments, or maintaining trip records. Even if the data seems limited, the healthcare context is what matters.

      The role of the NEMT provider in these scenarios is not just logistical. It supports treatment access, continuity of care, and patient outcomes. From a regulatory standpoint, that places the organization squarely within the definition of a Business Associate.

      The Role of Data Storage and Technology

      Many NEMT providers assume HIPAA only applies when they actively use patient information. In reality, simply maintaining or storing PHI is enough to trigger Business Associate status.

      Trip manifests, dispatch software, billing platforms, and ride history logs often contain patient identifiers linked to healthcare services. These systems—whether cloud-based or local—must be evaluated through a HIPAA compliance lens.

      Communication tools are another important factor. Dispatch-to-driver coordination frequently involves mobile apps, texting, or call systems. If these channels include PHI, they must be secured appropriately. Standard consumer tools without safeguards can create immediate compliance risks.

      What HIPAA Requires from NEMT Business Associates

      Once classified as a Business Associate, an NEMT organization takes on defined responsibilities under HIPAA.

      This includes executing Business Associate Agreements (BAAs) with covered entities, implementing safeguards to protect PHI, and training workforce members on privacy and security expectations. Organizations are also responsible for identifying risks, monitoring their environment, and responding to potential breaches.

      Importantly, these obligations apply across the organization—not just in the back office. Drivers, dispatchers, and management all play a role in protecting patient information.

      Common Misunderstandings in the NEMT Industry

      A frequent misconception is that NEMT providers are “just transportation” and therefore outside the scope of healthcare regulation. In reality, the moment transportation is linked to medical care and involves patient-specific information, the regulatory landscape changes.

      This misunderstanding often leads to gaps such as missing BAAs, unsecured devices, or untrained staff. Over time, these issues increase exposure to audits, penalties, and contract challenges with healthcare partners.

      Key Takeaways

      Most NEMT organizations working within healthcare networks should assume they are operating as Business Associates. The combination of receiving, storing, and using patient information tied to medical services establishes that role in the majority of cases.

      Compliance is not just a contractual requirement—it is a foundational part of operating responsibly within the healthcare ecosystem.

      Final Thoughts

      For NEMT providers, the question is rarely whether HIPAA applies, but rather whether compliance practices fully reflect that reality. Organizations that take a proactive approach—aligning their policies, technology, and workforce—are better positioned to reduce risk and strengthen partnerships.

      Next Steps for NEMT Providers

      At Colington Consulting, we specialize in helping NEMT providers operating as HIPAA Business Associates build proactive compliance programs. Contact us at 844-740-7100 or schedule a free 30-minute HIPAA risk review to evaluate your current compliance posture as an NEMT organization.

      • Reviewed on June 16, 2026 by: Jay Hodes, President – Colington Consulting, HIPAA Compliance Expert
      • Regulatory Sources:  45 CFR 164.502(e), 164.504(e), 164.532(d) and (e)  
      • Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal advice or an official regulatory determination. For specific guidance regarding your organization’s unique operational workflows, consult directly with a HIPAA compliance specialist or legal counsel.

    • What Are HIPAA Workforce Training Requirements?

      Under federal regulation 45 C.F.R. § 164.530(b)(1), all HIPAA Covered Entities and Business Associates are legally required to provide security and privacy training to every member of their workforce. Training must be delivered to new employees within a reasonable period after hiring and updated whenever a significant change occurs in company policies, software, or federal regulations. Failing to properly train employees is one of the most common triggers for Office for Civil Rights (OCR) investigations and costly financial settlements. A single employee clicking on a phishing link or mishandling Protected Health Information (PHI) can breach data security, transforming workforce training from a legal chore into your strongest line of defense.

      A common misconception is that HIPAA training is only for doctors, nurses, and medical staff. Under the law, workforce members is broadly defined to include full-time and part-time employees, volunteers, interns, contractors, and temporary staff. Administrative personnel in billing, human resources, IT, and reception roles must also be trained if they have any potential to encounter protected data. Essentially, if someone works under your direct control and could come into contact with PHI, they require formal compliance training.

      Timing is critical for maintaining a defensible position during an OCR audit. New workforce members must receive training within a reasonable period after joining the organization, which best practice dictates should occur within the first 30 to 90 days of employment. This onboarding training should ideally conclude before individuals are granted unsupervised access to systems containing Electronic Protected Health Information (ePHI). Additionally, if your organization updates its internal privacy policies, implements new Electronic Health Record (EHR) software, or if federal regulations change, affected workforce members must receive immediate retraining on those specific updates. While the law does not explicitly mandate annual training, the HIPAA Security Rule requires an ongoing security awareness training program, meaning compliance experts strongly recommend annual refresher courses alongside monthly phishing simulations.

      To satisfy both the Privacy and Security Rules, an effective training curriculum must address broad data handling principles alongside specific technological safeguards. Your training program must cover core privacy fundamentals, including what constitutes PHI, the minimum necessary standard, proper disclosure rules, and patient rights. On the technical side, employees need guidance on password management best practices, log-in monitoring protocols, and recognizing malware or phishing attempts. Finally, the training must cover organizational policies like mobile device management for personal devices, data backup protocols, physical data destruction, and clear instructions on your internal sanction policies for reporting a suspected data breach.

      If an auditor or investigator requests proof of compliance, simply stating that you train your staff is not enough. You must maintain audit-ready documentation, which means keeping signed acknowledgments or digital logs proving each employee completed their assigned modules. You must also log the exact dates training was completed and keep a record of the specific curriculum, slides, or videos used.

      Need help evaluating your organization’s current training protocols or overall compliance posture? You can schedule a HIPAA risk review with Colington Consulting to identify structural gaps before they lead to an enforcement action.

      • Reviewed on June 13, 2026, By: Jay Hodes, President – Colington Consulting, HIPAA Compliance Expert
      • Regulatory Source: The formal regulatory source for HIPAA workforce training requirements is 45 C.F.R. § 164.530(b)(1). This specific section falls under the administrative requirements of the HIPAA Privacy Rule, which dictates that a Covered Entity or Business Associate must train all members of its workforce on the policies and procedures regarding Protected Health Information (PHI) as necessary and appropriate for them to carry out their functions within the organization.
      • Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal advice or an official regulatory determination. For specific guidance regarding your organization’s unique operational workflows, consult directly with a HIPAA compliance specialist or legal counsel.

    • How to Properly Dispose of PHI and ePHI Under HIPAA Regulations

      Healthcare organizations and business associates handle massive amounts of Protected Health Information (PHI) daily. However, managing data securely doesn’t stop while it is in use—it extends through final destruction. Failing to securely dispose of patient records is one of the quickest ways to trigger an Office for Civil Rights (OCR) investigation, leading to severe data breaches and costly compliance fines.

      Here is what your organization needs to know about meeting HIPAA disposal requirements for both physical and electronic records.

      What Are the HIPAA Requirements for Disposing of PHI?

      The Health Insurance Portability and Accountability Act (HIPAA) does not mandate one specific method for destroying records. Instead, it requires organizations to implement reasonable and appropriate safeguards to ensure patient data cannot be reconstructed or impermissibly disclosed.

      The HIPAA Privacy Rule and Paper Records

      Under 45 CFR 164.530(c), covered entities and business associates must apply administrative, technical, and physical safeguards to protect the privacy of PHI through its final disposition.

      • The Goal: Prevent data from being readable, reconstructed, or otherwise compromised during or after the disposal process.
      • Common Violation: Tossing intact paper charts, sign-in sheets, or billing records directly into a standard trash can or public dumpster.

      The HIPAA Security Rule and ePHI

      For digital data, 45 CFR 164.310(d)(2)(i) mandates strict policies and procedures regarding the final disposition of electronic PHI (ePHI) and the hardware or electronic media on which it is stored.

      • The Goal: Ensure that ePHI is permanently cleared or purged before electronic media is re-used, recycled, or thrown away.
      • Common Violation: Donating old office computers or discarding broken hard drives without completely degaussing or physically destroying the storage media.

      Approved Methods for HIPAA-Compliant Data Destruction

      Because federal law is flexible, your organization can choose the methods that best fit your workflow, provided they guarantee the data is unrecoverable.

      Destroying Paper Records and X-Rays

      For physical media, the objective is to ensure the PHI is rendered essentially unreadable and cannot be reconstructed. Approved disposal methods include shredding, burning, pulping, or incinerating the documents. Simply tearing up a patient chart by hand or throwing intact records into a recycling bin does not meet federal compliance standards.

      Destroying Electronic Media (ePHI)

      For digital data, organizations must ensure that ePHI cannot be retrieved from the hardware or electronic media on which it was stored. Compliant methods include clearing (overwriting the data with non-sensitive information), purging (degaussing or demagnetizing the media to flip the magnetic fields), or physical destruction of the hardware itself. Physical destruction of electronic media can be achieved through specialized disintegration, incineration, or hard drive shredding.

      Managing Off-Site and Remote Employee Disposal

      With the rise of remote work and telehealth, secure disposal extends far beyond the clinic walls. Under 45 CFR 164.530(b), your workforce must be actively trained on remote data destruction policies.

      To maintain compliance with off-site employees, organizations generally utilize one of two strategies:

      1. The Return Policy: Requiring remote workforce members to securely hold and return all physical PHI to the main facility for professional shredding and disposal.
      2. The Direct Shred Policy: Permitting employees to shred paper records themselves only if the organization provides approved shredding equipment and maintains a strict verification and logging process.

      Compliance Tip: If a workforce member fails to follow your established disposal protocols, HIPAA requires that your organization apply formal, documented sanctions to the employee.

      Streamline Your HIPAA Compliance Program

      Managing the final disposition of PHI requires clear, written policies and routine staff training. If you aren’t sure whether your current destruction protocols meet federal standards, we can help.

      Colington Consulting provides customized compliance programs, comprehensive policy development, and expert risk management plans to keep your organization defensibly positioned against OCR audits.

      Schedule Your Free 30-Minute HIPAA Risk Review Now

      Frequently Asked Questions About PHI Disposal

      Can you throw away paper charts in a dumpster if they are ripped up?

      No. Simply ripping up paper charts by hand does not meet the HIPAA standard of making the text completely unreadable and impossible to reconstruct. Documents must be thoroughly shredded, pulped, or incinerated.

      Does HIPAA require a certificate of destruction?

      While the text of the HIPAA Rules does not explicitly mandate a “certificate of destruction,” utilizing a third-party shredding vendor that provides one is considered an industry best practice. It serves as vital documentation during an OCR audit to prove your organization followed proper physical safeguards.

      • Reviewed By: Jay Hodes, President – Colington Consulting, HIPAA Compliance Expert
      • Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal advice or an official regulatory determination. For specific guidance regarding your organization’s unique operational workflows, consult directly with a HIPAA compliance specialist or legal counsel.

    • HIPAA Compliance: Timely Medical Records Access

      As a healthcare provider or business associate, you likely spend a massive amount of energy protecting patient data from unauthorized eyes. But are you equally focused on giving patients access to their own data?

      Under the HIPAA Privacy Rule, patients have a legal right to review and obtain copies of their protected health information (PHI). The HHS Office for Civil Rights (OCR) has aggressively ramped up its Right of Access Initiative, leveling heavy fines against organizations that delay or deny these requests.

      Below, we break down exactly what you need to do to stay compliant, avoid OCR penalties, and fulfill medical records requests efficiently.

      What is the HIPAA Right of Access Standard?

      The Core Rule: The HIPAA Right of Access standard requires covered entities to provide individuals (or their designated personal representatives) with access to inspect or obtain a copy of their PHI in a designated record set.

      This right applies regardless of whether the records are stored electronically (e.g., in an EHR system) or physically in paper files.

      How Quickly Must a Provider Respond to a Medical Records Request?

      According to guidelines from the U.S. Department of Health and Human Services (HHS), covered entities must provide the requested health information within 30 calendar days of receiving the request.

      Can You Get an Extension?

      Yes, but only under strict conditions:

      • If the records are archived off-site or otherwise not readily accessible, you may request a one-time, 30-day extension.
      • To legally claim this extension, you must provide the patient with a written explanation of the delay and the exact date they can expect their records.

      The Real Cost of Non-Compliance: OCR Enforcement Trends

      Many organizations mistakenly believe that minor administrative delays won’t trigger federal scrutiny. However, the OCR has made it clear that ignoring the 30-day window can lead to steep penalties.

      In one notable Right of Access enforcement action—the 19th case resolved under the initiative—a provider took nearly two years to deliver a child’s medical records to their parent. The result? The organization was forced to implement a strict corrective action plan and pay a $5,000 settlement for a single potential violation. Bigger organizations have faced six-figure fines for similar delays.

      Need Help With Your HIPAA Compliance Program?

      HIPAA violations often stem from small, overlooked gaps in daily operations. Don’t wait for a patient complaint to trigger a federal investigation.

      At Colington Consulting, we specialize in helping healthcare organizations and business associates build proactive compliance programs. Contact us at 844-740-7100 or schedule a free 30-minute HIPAA risk review to evaluate your current policies and protect your practice.

      • Reviewed By: Jay Hodes, President – Colington Consulting, HIPAA Compliance Expert
      • Regulatory Sources: The HIPAA Privacy Rule (45 CFR § 164.524): This is the core federal regulation that establishes a patient’s legal right to inspect and obtain a copy of their protected health information (PHI). Specifically, 45 CFR § 164.524(b)(2) dictates the 30-day response timeline and the strict conditions required for a one-time, 30-day extension. HHS OCR Enforcement Guidance: The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) provides official regulatory guidance and actively enforces these timelines under its ongoing Right of Access Initiative, which targets covered entities that fail to provide timely access to records.
      • Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal advice or an official regulatory determination. For specific guidance regarding your organization’s unique operational workflows, consult directly with a HIPAA compliance specialist or legal counsel.

    • HIPAA and Social Media: What are the Rules?

      by Jay Hodes, President – Colington Consulting 

      The use of social media in today’s society continues to grow as more Americans interact through one or more social media platforms. Whether writing a blog article, posting on Facebook or tweeting on Twitter, many users see social media as a primary means to communicate. According the Pew Research Center, as many as 46% of users “discussed a news issue or event” on a social media platform.

      As more healthcare providers use or consider using social media for business purposes, HIPAA plays a more significant role in what can be said in a Facebook post, a tweet or a blog article. There are some clear challenges when it comes to meeting the requirements of the HIPAA Privacy Rule. But those challenges do not need to be obstacles, as long as there is proper guidance on what can or cannot be posted. 

      My advice when it comes to the use of social media in a healthcare organization is to have a comprehensive, written policy and procedure. The less discretion the better, meaning there is always structured guidance to follow with little to no wiggle room.

      In formulating your organization’s social media policy, start with the 3 W’s: Who, What and Where.  

      • Who – Determine who is permitted to post material on social media on behalf of the organization. Designate a specific person as the organization’s official social media administrator.
      • What – Determine what can be posted. The policy should include how to handle an individual that posts a medical question on a social media platform. As an example, if a patient can ask specific questions about a medical condition on your Facebook page, how does your organization address it? I caution from a possible liability standpoint that it may be inappropriate to respond with advice. A better response would be to ask the individual to contact the office to discuss the specific concern.
      • Where – Determine where and on what platforms posting will occur. The policy must clearly state which social media sites the organization will use.  

      Guidelines issued by the AMA on social media say, “Be cognizant of standards of patient privacy and confidentiality. Don’t post sensitive patient information online or transmit it without appropriate protection.” The guidelines also say to “maintain the appropriate boundaries of the patient-physician relationship, just as in any other context.” This means following all the applicable standards of the HIPAA Privacy Rule.

      Another area of concern is the use of patient testimonials. This is a somewhat newer trend in the healthcare provider marketing strategy. Any patient testimonials used by a healthcare organization must comply with the HIPAA Privacy Rule. A healthcare provider, as a covered entity, must obtain the written authorization of the patient prior to any use or disclosure of the individual’s protected health information for marketing purposes.

      In an enforcement case, a California physical therapy practice paid a settlement of $25,000 to the HHS Office for Civil Rights for a HIPAA privacy violation. There were allegations that the practice posted patient testimonials to its website without legal, HIPAA-compliant authorization. This is not a situation you want to find yourself in.

      If your organization embraces social media as a method to market or provide information, have robust policies and procedures in place and follow them. You can be social, but be safe.

      Schedule a 30-Minute HIPAA Risk Review and find out if your organization’s social media policy stands up to the HIPAA Privacy Rule

    • Does HIPAA Apply to Dental Practices? What You Must Know

      A dangerous misconception persists within the oral healthcare community: many dental practices believe they are flying beneath the regulatory radar of federal investigators. Because dental offices rarely handle large-scale, inpatient medical care, practitioners frequently assume that HIPAA compliance is a burden reserved exclusively for large hospitals and medical groups.

      This assumption is entirely false.

      The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) actively regulates and enforces HIPAA compliance across all dental specialties—including general dentistry, orthodontics, periodontics, and oral surgery. If your practice transmits even one standard transaction electronically, such as submitting a digital dental insurance claim or checking patient eligibility online, you are legally classified as a Covered Entity.

      Treating HIPAA compliance as an afterthought doesn’t keep you under the radar—it makes your practice a prime target for severe financial penalties.

      High-Risk Vulnerabilities Unique to Dental Offices

      While dental practices share many general compliance burdens with standard medical practices, certain operational habits place dental offices at an elevated risk for data breaches and OCR scrutiny.

      1. Unencrypted Communication with Specialists

      Dental practitioners frequently collaborate with external oral surgeons, labs, and endodontists. Sending patient X-rays, treatment plans, or clinical notes via standard, unencrypted email or text messages (like iMessage or WhatsApp) is an immediate HIPAA Security Rule violation. All peer-to-peer digital sharing must utilize a secure, encrypted portal or encrypted email solution.

      2. Exposed Operatory Screens

      The physical layout of a modern dental operatory often places computer monitors right next to the patient chair. If a monitor displays a previous patient’s digital charting, panoramic X-rays, or scheduling data while another patient is walking in or sitting in the chair, it constitutes an unauthorized disclosure of Protected Health Information (PHI).

      3. Missing Business Associate Agreements (BAAs)

      Dental practices rely heavily on specialized third-party vendors, including dental practice management software (e.g., Dentrix, Eaglesoft), IT support providers, and digital imaging cloud services. If these vendors touch, store, or transmit your patient data and you do not have a signed Business Associate Agreement (BAA) on file, your practice is operating in direct non-compliance.

      Actionable Safeguards for a Defensible Dental Practice

      To transition your office from vulnerable to audit-ready, you must implement three foundational physical, administrative, and technical controls immediately:

      • Install Monitor Privacy Filters: Equip all operatory and front-desk computer screens with physical privacy filters. This ensures that data is only visible to the staff member standing directly in front of the screen, eliminating accidental visual disclosure to patients in adjacent spaces.
      • Execute Comprehensive Risk Analyses: HIPAA mandates that every covered entity perform a formal, documented Security Risk Analysis (SRA). You cannot protect your network if you have not actively mapped out where your patient data is stored, backed up, and transmitted.
      • Train Dental Staff Annually: From dental hygienists to front-office schedulers, your entire workforce must undergo documented HIPAA training. A significant percentage of dental data breaches result from simple employee mistakes, such as clicking a phishing link or releasing records to the wrong family member.

      Defend Your Practice

      Operating a busy dental practice requires balancing patient care with strict administrative oversight. Ignoring regulatory obligations because you run a smaller clinic is no longer a viable operational strategy. The OCR does not grant exemptions based on practice size.

      Are your digital charting workflows, employee training logs, and IT vendor contracts fully audit-ready? Colington Consulting provides tailored, evidence-based compliance programs specifically designed to protect dental offices from operational liability and costly federal penalties.

      Schedule a 30-Minute HIPAA Risk Review and protect your dental practice.

      • Reviewed By: Jay Hodes, President – Colington Consulting, HIPAA Compliance Expert
      • Regulatory Sources: U.S. Department of Health and Human Services (HHS) Enforcement Data; HIPAA Security Rule (45 CFR Part 160 and Part 164, Subparts A and C).
      • Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal advice or an official regulatory determination. For specific guidance regarding your organization’s unique operational workflows, consult directly with a HIPAA compliance specialist or legal counsel.

    • Does HIPAA Prohibit the Use of Patient Sign-In Sheets?

      A common misconception among medical practices, dental clinics, and physical therapy centers is that the HIPAA Privacy Rule completely outlaws physical or digital patient sign-in sheets.

      It does not.

      The U.S. Department of Health and Human Services (HHS) explicitly permits the use of patient sign-in sheets. However, they are classified under the “incidental disclosure” doctrine. This means that while a sign-in sheet is a permissible administrative tool, its usage is legal only if your practice implements reasonable physical and administrative safeguards to limit the exposure of Protected Health Information (PHI).

      Leaving a highly detailed running list of patient data exposed on a clipboard at the front desk is a compliance failure that invites complaints, OCR scrutiny, and potential penalties.

      The Core Rule: What Can (and Cannot) Be Visible

      Under the HIPAA Privacy Rule, a sign-in sheet cannot serve as a clinical history log. Other patients standing at the front desk should only see the bare minimum required to check someone in.

      Permissible Information on a Sign-In Sheet

      Under the HIPAA Privacy Rule, a sign-in sheet is allowed to capture the bare minimum required for basic administrative check-in. It is completely acceptable to ask for the patient’s name, their arrival time, and the name of the specific doctor or provider they are scheduled to see.

      Strictly Prohibited Data (HIPAA Violations)

      The line is crossed when a sign-in sheet begins to act as a clinical history log. To avoid a compliance violation, a sign-in sheet must never display the reason for the visit or medical symptoms, any medical conditions or diagnoses, insurance provider details, or sensitive personal identifiers like a Social Security Number or Date of Birth.

      The Red Line: A patient standing at the counter should never be able to look at the sheet and deduce why the person before them is visiting the clinic. Writing “John Doe — 10:00 AM” is acceptable. Writing “John Doe — 10:00 AM — Chest Pain” or “John Doe — Oncologist Dr. Smith” in a multi-specialty clinic crosses into non-compliant PHI exposure.

      Actionable Safeguards: Moving Beyond the Clipboard

      To ensure your sign-in process is legally defensible during a compliance review, your practice must implement operational controls. Relying on an open-face, continuous paper logbook is no longer a best practice.

      Implement these three physical and technical safeguards immediately:

      1. Peel-Off / Label Sign-In Sheets

      If your practice relies on paper, use a security sign-in sheet system featuring adhesive peel-off strips. When a patient signs in, the front desk receptionist peels off the strip containing the name and takes it to the back office. The next patient only sees a blank backing sheet, completely eliminating the risk of peer-to-peer data exposure.

      2. Physical Barrier Controls

      Position the sign-in area so it is entirely within the clear line of sight of your administrative staff, but shielded from waiting room occupants. Use privacy screens or desk geometry to ensure that patients standing in line cannot hover over or read the clipboard.

      3. Digital Intake Kiosks (Technical Safeguards)

      Many modern practices have shifted to tablets or digital kiosks. While an excellent alternative to paper, kiosks introduce technical safeguard requirements. Ensure that:

      • The screen automatically times out or clears after a brief period of inactivity.
      • Privacy filters are installed on the glass to prevent “shoulder surfing.”
      • The software does not display a rolling list of previously checked-in patients on the home screen.

      Workforce Compliance: Training the Front Desk

      Even the best physical safeguards fail without continuous workforce enforcement. Your administrative staff must understand that handling sign-in sheets requires active risk ownership.

      • Turn It Over: If utilizing a temporary paper sheet, staff must flip the clipboard face-down whenever they step away from the front desk.
      • Shred Daily: Once a paper sign-in sheet or the peeled backing strips have served their administrative purpose for the day, they must be disposed of in a locked shredding bin. They must never be thrown into a standard trash can.
      • Enforce Boundaries: Train front-desk personnel to gently instruct waiting patients to stand back behind a designated marker line until it is their turn to check in.

      Defend Your Process

      Using a patient sign-in sheet is an efficient workflow tool, but it requires deliberate management. Compliance fails when a practice treats day-to-day administrative routines as exempt from privacy standards.

      Is your front desk layout, digital intake process, or paper documentation protocol audit-ready? Colington Consulting provides operational, evidence-based compliance programs that protect your practice from penalties and risk.

      Schedule a 30-Minute HIPAA Risk Review and evaluate your clinic’s safeguards.

      • Reviewed By: Jay Hodes, President – Colington Consulting, HIPAA Compliance Expert
      • Regulatory Sources: U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) Guidance on “Incidental Uses and Disclosures” (45 CFR 164.502(a)(1)(iii)).
      • Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal advice or an official regulatory determination. For specific guidance regarding your organization’s unique operational workflows, consult directly with a HIPAA compliance specialist or legal counsel.

    • HIPAA Rules for Paper Records in 2026

      Reviewed by: Jay Hodes, President – Colington Consulting, HIPAA Compliance Expert

      While modern healthcare compliance heavily focuses on cybersecurity and electronic Protected Health Information (ePHI), physical security remains a critical vulnerability. The Department of Health and Human Services (HHS) and the Office for Civil Rights (OCR) continue to penalize organizations for failing to safeguard physical documents.

      Improperly handled paper records, such as files left on desks, unkeyed filing cabinets, or un-shredded documents thrown into standard recycling bins—account for a massive portion of easily avoidable HIPAA violations.

      Whether your team operates in a traditional clinic or a hybrid office environment, understanding your responsibility to safeguard paper records is essential to protecting patient privacy and avoiding costly penalties.

      What Does HIPAA Require for Paper Records?

      The HIPAA Security Rule primarily governs electronic data, but the HIPAA Privacy Rule strictly mandates that Covered Entities and Business Associates apply appropriate administrative, technical, and physical safeguards to protect PHI in any form, including paper.

      To remain compliant, your organization must ensure physical records are protected throughout their entire lifecycle: creation, storage, usage, and disposal.

      Core Safeguards for Physical Files:

      • The “Clean Desk” Principle: Employees must not leave documents containing PHI exposed on desks, counters, or workstations when they step away.
      • Dual-Lock Custody: Paper charts, intake forms, and billing statements should be stored behind locked doors and inside locked filing cabinets when not in active use.
      • Strict Access Controls: Access to file rooms should be restricted only to authorized personnel who require the information to perform their specific job duties.

      The Remote & Hybrid Work Blindspot

      The shift toward remote and hybrid work environments has introduced significant new risks for physical PHI. When administrative or billing staff work from home, the boundaries of your secure facility disappear.

      If your employees handle paper records remotely, your compliance policies must adapt:

      1. No Home Printing: Prohibit the printing of patient schedules, medical notes, or billing details on personal home printers unless explicitly authorized and monitored under a strict remote work agreement.
      2. Secure Home Storage: If paper PHI must be taken home, it cannot be left on kitchen counters or shared desks where family members or visitors can see it. It must be locked away.
      3. Prohibited Disposal: Employees must never discard paper PHI in home trash cans or residential recycling bins. Documents must either be brought back to the office for secure destruction or shredded at home using an approved cross-cut shredder.

      Proper Disposal: The “Shred-All” Solution

      The absolute highest risk associated with paper records occurs during disposal. Dumpster-diving incidents and accidental exposure of intact records are viewed severely by federal investigators.

      Under HIPAA, acceptable methods for destroying paper records include burning, pulverizing, melting, or shredding so that the PHI is rendered essentially unreadable and cannot be reconstructed.

      Implementing a “shred-all” policy across your organization removes the guesswork for your staff. If every document goes into a secure, locked shredding bin, the risk of a human error leading to a breach drops dramatically.

      Are Your Physical & Digital Safeguards Audit-Ready?

      Leaving paper records vulnerable is one of the fastest ways to fail a routine compliance check or trigger an OCR investigation. Don’t wait for an accidental exposure to discover the gaps in your practice’s physical security.

      Schedule your 30-Minute HIPAA Risk Review. Our experts will help you identify hidden vulnerabilities in your workflow and ensure your safeguards are completely defensible.

      Sources & Legal References:

      • U.S. Department of Health and Human Services (HHS)
      • Office for Civil Rights (OCR) 

      Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal or regulatory compliance advice. Reading this article does not establish a consulting relationship with Colington Consulting. For specific guidance regarding your organization’s unique HIPAA obligations, please consult directly with a compliance professional. 

    • Cybersecurity & HIPAA Compliance: Ransomware Enforcement Cases

      How Ransomware Is Driving OCR Enforcement

      What is the connection between cybersecurity and HIPAA?

      Cybersecurity is a core requirement of HIPAA compliance. The HIPAA Security Rule mandates that healthcare organizations implement administrative, technical, and physical safeguards to protect electronic protected health information (ePHI).

      As ransomware attacks increase, regulators now treat weak cybersecurity controls as direct HIPAA violations, not just IT failures.

      Why is ransomware increasing HIPAA enforcement?

      Ransomware incidents often expose gaps in compliance programs. When attackers encrypt or steal ePHI, the Office for Civil Rights (OCR)investigates whether the organization:

      • Conducted a risk analysis
      • Implemented access controls
      • Maintained system security and patching
      • Documented safeguards

      If these are missing, fines and settlements are likely, even if the attack itself was external.

      How Ransomware Is Reshaping HIPAA Compliance

      Ransomware has made healthcare one of the most targeted sectors for cyberattacks. As a result, HIPAA compliance now requires continuous cybersecurity risk management, not just annual documentation.

      OCR enforcement trends show that organizations are penalized most often for:

      • Failure to perform a risk analysis
      • Lack of multi-factor authentication (MFA)
      • Unpatched systems or outdated software
      • Insufficient audit controls and monitoring

      These findings confirm that cybersecurity weaknesses directly translate into HIPAA Security Rule violations.

      OCR Enforcement Examples and Common Violations

      1. Lack of Risk Analysis

      OCR consistently identifies missing or incomplete risk assessments as a top violation. Organizations must demonstrate they actively identify and mitigate risks.

      What is a Security Risk Assessment?

      A proper risk analysis is not optional—it is the foundation of HIPAA compliance.

      2. Weak Access Controls

      Ransomware attackers commonly exploit poor authentication and user access management. OCR frequently cites:

      • No MFA
      • Shared logins
      • Excessive user privileges

      3. Inadequate System Security

      Failure to patch systems or monitor networks allows ransomware to spread quickly. OCR expects proactive vulnerability management and real-time detection.

      What Cybersecurity Measures Are Required for HIPAA Compliance?

      To meet modern HIPAA expectations, healthcare organizations should implement:

      • Enterprise-wide risk assessments
      • Endpoint detection and response (EDR)
      • Secure, tested backups
      • Email security and phishing prevention
      • Continuous monitoring and audit logging
      • Workforce security training

      These safeguards must be documented and regularly updated.

      How to Align Cybersecurity with HIPAA Requirements

      Organizations must move from reactive compliance to integrated security programs.

      At Colington Consulting we help healthcare organizations align cybersecurity with HIPAA requirements.

      What services are needed to meet HIPAA requirements?

      Our approach combines regulatory expertise with real-world threat protection, reducing both breach risk and enforcement exposure. For additional guidance, visit our HIPAA compliance blog page.

      Key Takeaways

      • Cybersecurity failures are now HIPAA violations
      • Ransomware drives increased OCR enforcement actions
      • Risk analysis is the most commonly cited deficiency
      • Organizations must implement proactive, continuous security controls
      • Compliance now requires operational cybersecurity, not just policies

      FAQ

      Are ransomware-related HIPAA breaches made public by OCR?

      Yes. As required by the HITECH Act, OCR posts on the HHS website a list of breaches of unsecured protected health information affecting 500 or more individuals.

      What is the most common HIPAA violation in ransomware cases?

      Failure to conduct a comprehensive risk analysis is the most frequent violation cited by OCR.

      Does HIPAA require cybersecurity frameworks like NIST?

      HIPAA does not mandate NIST, but OCR expects organizations to follow recognized security standards to meet compliance requirements.

      Schedule a 30 minute HIPAA Risk Review

    Helping healthcare organizations navigate HIPAA requirements, reduce compliance risks, and protect sensitive health information.

    Quick Links

    Our Services

    Specialty Services

    Need Help?

    Facebook X-twitter Linkedin Youtube

    © 2026 Colington Consulting. All rights reserved.