844-740-7100

    Colington Consulting

    Helping Organizations Achieve HIPAA Compliance™

    Contact Us

    Author: Colington Consulting

    • When Are NEMT Organizations HIPAA Business Associates?

      Non-Emergency Medical Transportation (NEMT) providers serve a critical role in helping patients access healthcare services. However, one of the most common compliance questions in the industry is straightforward: When is a NEMT organization considered a HIPAA Business Associate?

      For most providers, the answer is simpler than expected—yet often misunderstood.

      Understanding the Business Associate Role

      A HIPAA Business Associate (BA) is any organization that creates, receives, maintains, or transmits Protected Health Information (PHI) on behalf of a covered entity, such as a healthcare provider, health plan, or managed care organization.

      PHI includes identifiable information connected to healthcare services. In the NEMT context, that often looks like patient names tied to medical appointments, transportation arranged for treatment, Medicaid identifiers, or trip data linked to healthcare delivery.

      If your operations involve this type of information, even at a basic level, HIPAA likely applies.

      How NEMT Providers Become Business Associates

      In most healthcare transportation models, NEMT organizations are functioning as an extension of the healthcare system. This is particularly true in Medicaid and broker-driven environments, where transportation is a defined benefit tied to care.

      When trip requests are received from a broker, hospital, dialysis center, or health plan, they almost always include information that connects an individual to medical services. That connection is what transforms routine transportation data into PHI.

      Dispatch teams, drivers, and administrative staff all interact with this information in some form—whether scheduling rides, confirming appointments, or maintaining trip records. Even if the data seems limited, the healthcare context is what matters.

      The role of the NEMT provider in these scenarios is not just logistical. It supports treatment access, continuity of care, and patient outcomes. From a regulatory standpoint, that places the organization squarely within the definition of a Business Associate.

      The Role of Data Storage and Technology

      Many NEMT providers assume HIPAA only applies when they actively use patient information. In reality, simply maintaining or storing PHI is enough to trigger Business Associate status.

      Trip manifests, dispatch software, billing platforms, and ride history logs often contain patient identifiers linked to healthcare services. These systems—whether cloud-based or local—must be evaluated through a HIPAA compliance lens.

      Communication tools are another important factor. Dispatch-to-driver coordination frequently involves mobile apps, texting, or call systems. If these channels include PHI, they must be secured appropriately. Standard consumer tools without safeguards can create immediate compliance risks.

      What HIPAA Requires from NEMT Business Associates

      Once classified as a Business Associate, an NEMT organization takes on defined responsibilities under HIPAA.

      This includes executing Business Associate Agreements (BAAs) with covered entities, implementing safeguards to protect PHI, and training workforce members on privacy and security expectations. Organizations are also responsible for identifying risks, monitoring their environment, and responding to potential breaches.

      Importantly, these obligations apply across the organization—not just in the back office. Drivers, dispatchers, and management all play a role in protecting patient information.

      Common Misunderstandings in the NEMT Industry

      A frequent misconception is that NEMT providers are “just transportation” and therefore outside the scope of healthcare regulation. In reality, the moment transportation is linked to medical care and involves patient-specific information, the regulatory landscape changes.

      This misunderstanding often leads to gaps such as missing BAAs, unsecured devices, or untrained staff. Over time, these issues increase exposure to audits, penalties, and contract challenges with healthcare partners.

      Key Takeaways

      Most NEMT organizations working within healthcare networks should assume they are operating as Business Associates. The combination of receiving, storing, and using patient information tied to medical services establishes that role in the majority of cases.

      Compliance is not just a contractual requirement—it is a foundational part of operating responsibly within the healthcare ecosystem.

      Final Thoughts

      For NEMT providers, the question is rarely whether HIPAA applies, but rather whether compliance practices fully reflect that reality. Organizations that take a proactive approach—aligning their policies, technology, and workforce—are better positioned to reduce risk and strengthen partnerships.

      Next Steps for NEMT Providers

      At Colington Consulting, we specialize in helping NEMT providers operating as HIPAA Business Associates build proactive compliance programs. Contact us at 844-740-7100 or schedule a free 30-minute HIPAA risk review to evaluate your current compliance posture as an NEMT organization.

      • Reviewed on June 16, 2026 by: Jay Hodes, President – Colington Consulting, HIPAA Compliance Expert
      • Regulatory Sources:  45 CFR 164.502(e), 164.504(e), 164.532(d) and (e)  
      • Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal advice or an official regulatory determination. For specific guidance regarding your organization’s unique operational workflows, consult directly with a HIPAA compliance specialist or legal counsel.

    • What Are HIPAA Workforce Training Requirements?

      Under federal regulation 45 C.F.R. § 164.530(b)(1), all HIPAA Covered Entities and Business Associates are legally required to provide security and privacy training to every member of their workforce. Training must be delivered to new employees within a reasonable period after hiring and updated whenever a significant change occurs in company policies, software, or federal regulations. Failing to properly train employees is one of the most common triggers for Office for Civil Rights (OCR) investigations and costly financial settlements. A single employee clicking on a phishing link or mishandling Protected Health Information (PHI) can breach data security, transforming workforce training from a legal chore into your strongest line of defense.

      A common misconception is that HIPAA training is only for doctors, nurses, and medical staff. Under the law, workforce members is broadly defined to include full-time and part-time employees, volunteers, interns, contractors, and temporary staff. Administrative personnel in billing, human resources, IT, and reception roles must also be trained if they have any potential to encounter protected data. Essentially, if someone works under your direct control and could come into contact with PHI, they require formal compliance training.

      Timing is critical for maintaining a defensible position during an OCR audit. New workforce members must receive training within a reasonable period after joining the organization, which best practice dictates should occur within the first 30 to 90 days of employment. This onboarding training should ideally conclude before individuals are granted unsupervised access to systems containing Electronic Protected Health Information (ePHI). Additionally, if your organization updates its internal privacy policies, implements new Electronic Health Record (EHR) software, or if federal regulations change, affected workforce members must receive immediate retraining on those specific updates. While the law does not explicitly mandate annual training, the HIPAA Security Rule requires an ongoing security awareness training program, meaning compliance experts strongly recommend annual refresher courses alongside monthly phishing simulations.

      To satisfy both the Privacy and Security Rules, an effective training curriculum must address broad data handling principles alongside specific technological safeguards. Your training program must cover core privacy fundamentals, including what constitutes PHI, the minimum necessary standard, proper disclosure rules, and patient rights. On the technical side, employees need guidance on password management best practices, log-in monitoring protocols, and recognizing malware or phishing attempts. Finally, the training must cover organizational policies like mobile device management for personal devices, data backup protocols, physical data destruction, and clear instructions on your internal sanction policies for reporting a suspected data breach.

      If an auditor or investigator requests proof of compliance, simply stating that you train your staff is not enough. You must maintain audit-ready documentation, which means keeping signed acknowledgments or digital logs proving each employee completed their assigned modules. You must also log the exact dates training was completed and keep a record of the specific curriculum, slides, or videos used.

      Need help evaluating your organization’s current training protocols or overall compliance posture? You can schedule a HIPAA risk review with Colington Consulting to identify structural gaps before they lead to an enforcement action.

      • Reviewed on June 13, 2026, By: Jay Hodes, President – Colington Consulting, HIPAA Compliance Expert
      • Regulatory Source: The formal regulatory source for HIPAA workforce training requirements is 45 C.F.R. § 164.530(b)(1). This specific section falls under the administrative requirements of the HIPAA Privacy Rule, which dictates that a Covered Entity or Business Associate must train all members of its workforce on the policies and procedures regarding Protected Health Information (PHI) as necessary and appropriate for them to carry out their functions within the organization.
      • Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal advice or an official regulatory determination. For specific guidance regarding your organization’s unique operational workflows, consult directly with a HIPAA compliance specialist or legal counsel.

    • How to Properly Dispose of PHI and ePHI Under HIPAA Regulations

      Healthcare organizations and business associates handle massive amounts of Protected Health Information (PHI) daily. However, managing data securely doesn’t stop while it is in use—it extends through final destruction. Failing to securely dispose of patient records is one of the quickest ways to trigger an Office for Civil Rights (OCR) investigation, leading to severe data breaches and costly compliance fines.

      Here is what your organization needs to know about meeting HIPAA disposal requirements for both physical and electronic records.

      What Are the HIPAA Requirements for Disposing of PHI?

      The Health Insurance Portability and Accountability Act (HIPAA) does not mandate one specific method for destroying records. Instead, it requires organizations to implement reasonable and appropriate safeguards to ensure patient data cannot be reconstructed or impermissibly disclosed.

      The HIPAA Privacy Rule and Paper Records

      Under 45 CFR 164.530(c), covered entities and business associates must apply administrative, technical, and physical safeguards to protect the privacy of PHI through its final disposition.

      • The Goal: Prevent data from being readable, reconstructed, or otherwise compromised during or after the disposal process.
      • Common Violation: Tossing intact paper charts, sign-in sheets, or billing records directly into a standard trash can or public dumpster.

      The HIPAA Security Rule and ePHI

      For digital data, 45 CFR 164.310(d)(2)(i) mandates strict policies and procedures regarding the final disposition of electronic PHI (ePHI) and the hardware or electronic media on which it is stored.

      • The Goal: Ensure that ePHI is permanently cleared or purged before electronic media is re-used, recycled, or thrown away.
      • Common Violation: Donating old office computers or discarding broken hard drives without completely degaussing or physically destroying the storage media.

      Approved Methods for HIPAA-Compliant Data Destruction

      Because federal law is flexible, your organization can choose the methods that best fit your workflow, provided they guarantee the data is unrecoverable.

      Destroying Paper Records and X-Rays

      For physical media, the objective is to ensure the PHI is rendered essentially unreadable and cannot be reconstructed. Approved disposal methods include shredding, burning, pulping, or incinerating the documents. Simply tearing up a patient chart by hand or throwing intact records into a recycling bin does not meet federal compliance standards.

      Destroying Electronic Media (ePHI)

      For digital data, organizations must ensure that ePHI cannot be retrieved from the hardware or electronic media on which it was stored. Compliant methods include clearing (overwriting the data with non-sensitive information), purging (degaussing or demagnetizing the media to flip the magnetic fields), or physical destruction of the hardware itself. Physical destruction of electronic media can be achieved through specialized disintegration, incineration, or hard drive shredding.

      Managing Off-Site and Remote Employee Disposal

      With the rise of remote work and telehealth, secure disposal extends far beyond the clinic walls. Under 45 CFR 164.530(b), your workforce must be actively trained on remote data destruction policies.

      To maintain compliance with off-site employees, organizations generally utilize one of two strategies:

      1. The Return Policy: Requiring remote workforce members to securely hold and return all physical PHI to the main facility for professional shredding and disposal.
      2. The Direct Shred Policy: Permitting employees to shred paper records themselves only if the organization provides approved shredding equipment and maintains a strict verification and logging process.

      Compliance Tip: If a workforce member fails to follow your established disposal protocols, HIPAA requires that your organization apply formal, documented sanctions to the employee.

      Streamline Your HIPAA Compliance Program

      Managing the final disposition of PHI requires clear, written policies and routine staff training. If you aren’t sure whether your current destruction protocols meet federal standards, we can help.

      Colington Consulting provides customized compliance programs, comprehensive policy development, and expert risk management plans to keep your organization defensibly positioned against OCR audits.

      Schedule Your Free 30-Minute HIPAA Risk Review Now

      Frequently Asked Questions About PHI Disposal

      Can you throw away paper charts in a dumpster if they are ripped up?

      No. Simply ripping up paper charts by hand does not meet the HIPAA standard of making the text completely unreadable and impossible to reconstruct. Documents must be thoroughly shredded, pulped, or incinerated.

      Does HIPAA require a certificate of destruction?

      While the text of the HIPAA Rules does not explicitly mandate a “certificate of destruction,” utilizing a third-party shredding vendor that provides one is considered an industry best practice. It serves as vital documentation during an OCR audit to prove your organization followed proper physical safeguards.

      • Reviewed By: Jay Hodes, President – Colington Consulting, HIPAA Compliance Expert
      • Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal advice or an official regulatory determination. For specific guidance regarding your organization’s unique operational workflows, consult directly with a HIPAA compliance specialist or legal counsel.

    • HIPAA Compliance: Timely Medical Records Access

      As a healthcare provider or business associate, you likely spend a massive amount of energy protecting patient data from unauthorized eyes. But are you equally focused on giving patients access to their own data?

      Under the HIPAA Privacy Rule, patients have a legal right to review and obtain copies of their protected health information (PHI). The HHS Office for Civil Rights (OCR) has aggressively ramped up its Right of Access Initiative, leveling heavy fines against organizations that delay or deny these requests.

      Below, we break down exactly what you need to do to stay compliant, avoid OCR penalties, and fulfill medical records requests efficiently.

      What is the HIPAA Right of Access Standard?

      The Core Rule: The HIPAA Right of Access standard requires covered entities to provide individuals (or their designated personal representatives) with access to inspect or obtain a copy of their PHI in a designated record set.

      This right applies regardless of whether the records are stored electronically (e.g., in an EHR system) or physically in paper files.

      How Quickly Must a Provider Respond to a Medical Records Request?

      According to guidelines from the U.S. Department of Health and Human Services (HHS), covered entities must provide the requested health information within 30 calendar days of receiving the request.

      Can You Get an Extension?

      Yes, but only under strict conditions:

      • If the records are archived off-site or otherwise not readily accessible, you may request a one-time, 30-day extension.
      • To legally claim this extension, you must provide the patient with a written explanation of the delay and the exact date they can expect their records.

      The Real Cost of Non-Compliance: OCR Enforcement Trends

      Many organizations mistakenly believe that minor administrative delays won’t trigger federal scrutiny. However, the OCR has made it clear that ignoring the 30-day window can lead to steep penalties.

      In one notable Right of Access enforcement action—the 19th case resolved under the initiative—a provider took nearly two years to deliver a child’s medical records to their parent. The result? The organization was forced to implement a strict corrective action plan and pay a $5,000 settlement for a single potential violation. Bigger organizations have faced six-figure fines for similar delays.

      Need Help With Your HIPAA Compliance Program?

      HIPAA violations often stem from small, overlooked gaps in daily operations. Don’t wait for a patient complaint to trigger a federal investigation.

      At Colington Consulting, we specialize in helping healthcare organizations and business associates build proactive compliance programs. Contact us at 844-740-7100 or schedule a free 30-minute HIPAA risk review to evaluate your current policies and protect your practice.

      • Reviewed By: Jay Hodes, President – Colington Consulting, HIPAA Compliance Expert
      • Regulatory Sources: The HIPAA Privacy Rule (45 CFR § 164.524): This is the core federal regulation that establishes a patient’s legal right to inspect and obtain a copy of their protected health information (PHI). Specifically, 45 CFR § 164.524(b)(2) dictates the 30-day response timeline and the strict conditions required for a one-time, 30-day extension. HHS OCR Enforcement Guidance: The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) provides official regulatory guidance and actively enforces these timelines under its ongoing Right of Access Initiative, which targets covered entities that fail to provide timely access to records.
      • Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal advice or an official regulatory determination. For specific guidance regarding your organization’s unique operational workflows, consult directly with a HIPAA compliance specialist or legal counsel.

    • HIPAA and Social Media: What are the Rules?

      by Jay Hodes, President – Colington Consulting 

      The use of social media in today’s society continues to grow as more Americans interact through one or more social media platforms. Whether writing a blog article, posting on Facebook or tweeting on Twitter, many users see social media as a primary means to communicate. According the Pew Research Center, as many as 46% of users “discussed a news issue or event” on a social media platform.

      As more healthcare providers use or consider using social media for business purposes, HIPAA plays a more significant role in what can be said in a Facebook post, a tweet or a blog article. There are some clear challenges when it comes to meeting the requirements of the HIPAA Privacy Rule. But those challenges do not need to be obstacles, as long as there is proper guidance on what can or cannot be posted. 

      My advice when it comes to the use of social media in a healthcare organization is to have a comprehensive, written policy and procedure. The less discretion the better, meaning there is always structured guidance to follow with little to no wiggle room.

      In formulating your organization’s social media policy, start with the 3 W’s: Who, What and Where.  

      • Who – Determine who is permitted to post material on social media on behalf of the organization. Designate a specific person as the organization’s official social media administrator.
      • What – Determine what can be posted. The policy should include how to handle an individual that posts a medical question on a social media platform. As an example, if a patient can ask specific questions about a medical condition on your Facebook page, how does your organization address it? I caution from a possible liability standpoint that it may be inappropriate to respond with advice. A better response would be to ask the individual to contact the office to discuss the specific concern.
      • Where – Determine where and on what platforms posting will occur. The policy must clearly state which social media sites the organization will use.  

      Guidelines issued by the AMA on social media say, “Be cognizant of standards of patient privacy and confidentiality. Don’t post sensitive patient information online or transmit it without appropriate protection.” The guidelines also say to “maintain the appropriate boundaries of the patient-physician relationship, just as in any other context.” This means following all the applicable standards of the HIPAA Privacy Rule.

      Another area of concern is the use of patient testimonials. This is a somewhat newer trend in the healthcare provider marketing strategy. Any patient testimonials used by a healthcare organization must comply with the HIPAA Privacy Rule. A healthcare provider, as a covered entity, must obtain the written authorization of the patient prior to any use or disclosure of the individual’s protected health information for marketing purposes.

      In an enforcement case, a California physical therapy practice paid a settlement of $25,000 to the HHS Office for Civil Rights for a HIPAA privacy violation. There were allegations that the practice posted patient testimonials to its website without legal, HIPAA-compliant authorization. This is not a situation you want to find yourself in.

      If your organization embraces social media as a method to market or provide information, have robust policies and procedures in place and follow them. You can be social, but be safe.

      Schedule a 30-Minute HIPAA Risk Review and find out if your organization’s social media policy stands up to the HIPAA Privacy Rule

    • Does HIPAA Apply to Dental Practices? What You Must Know

      A dangerous misconception persists within the oral healthcare community: many dental practices believe they are flying beneath the regulatory radar of federal investigators. Because dental offices rarely handle large-scale, inpatient medical care, practitioners frequently assume that HIPAA compliance is a burden reserved exclusively for large hospitals and medical groups.

      This assumption is entirely false.

      The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) actively regulates and enforces HIPAA compliance across all dental specialties—including general dentistry, orthodontics, periodontics, and oral surgery. If your practice transmits even one standard transaction electronically, such as submitting a digital dental insurance claim or checking patient eligibility online, you are legally classified as a Covered Entity.

      Treating HIPAA compliance as an afterthought doesn’t keep you under the radar—it makes your practice a prime target for severe financial penalties.

      High-Risk Vulnerabilities Unique to Dental Offices

      While dental practices share many general compliance burdens with standard medical practices, certain operational habits place dental offices at an elevated risk for data breaches and OCR scrutiny.

      1. Unencrypted Communication with Specialists

      Dental practitioners frequently collaborate with external oral surgeons, labs, and endodontists. Sending patient X-rays, treatment plans, or clinical notes via standard, unencrypted email or text messages (like iMessage or WhatsApp) is an immediate HIPAA Security Rule violation. All peer-to-peer digital sharing must utilize a secure, encrypted portal or encrypted email solution.

      2. Exposed Operatory Screens

      The physical layout of a modern dental operatory often places computer monitors right next to the patient chair. If a monitor displays a previous patient’s digital charting, panoramic X-rays, or scheduling data while another patient is walking in or sitting in the chair, it constitutes an unauthorized disclosure of Protected Health Information (PHI).

      3. Missing Business Associate Agreements (BAAs)

      Dental practices rely heavily on specialized third-party vendors, including dental practice management software (e.g., Dentrix, Eaglesoft), IT support providers, and digital imaging cloud services. If these vendors touch, store, or transmit your patient data and you do not have a signed Business Associate Agreement (BAA) on file, your practice is operating in direct non-compliance.

      Actionable Safeguards for a Defensible Dental Practice

      To transition your office from vulnerable to audit-ready, you must implement three foundational physical, administrative, and technical controls immediately:

      • Install Monitor Privacy Filters: Equip all operatory and front-desk computer screens with physical privacy filters. This ensures that data is only visible to the staff member standing directly in front of the screen, eliminating accidental visual disclosure to patients in adjacent spaces.
      • Execute Comprehensive Risk Analyses: HIPAA mandates that every covered entity perform a formal, documented Security Risk Analysis (SRA). You cannot protect your network if you have not actively mapped out where your patient data is stored, backed up, and transmitted.
      • Train Dental Staff Annually: From dental hygienists to front-office schedulers, your entire workforce must undergo documented HIPAA training. A significant percentage of dental data breaches result from simple employee mistakes, such as clicking a phishing link or releasing records to the wrong family member.

      Defend Your Practice

      Operating a busy dental practice requires balancing patient care with strict administrative oversight. Ignoring regulatory obligations because you run a smaller clinic is no longer a viable operational strategy. The OCR does not grant exemptions based on practice size.

      Are your digital charting workflows, employee training logs, and IT vendor contracts fully audit-ready? Colington Consulting provides tailored, evidence-based compliance programs specifically designed to protect dental offices from operational liability and costly federal penalties.

      Schedule a 30-Minute HIPAA Risk Review and protect your dental practice.

      • Reviewed By: Jay Hodes, President – Colington Consulting, HIPAA Compliance Expert
      • Regulatory Sources: U.S. Department of Health and Human Services (HHS) Enforcement Data; HIPAA Security Rule (45 CFR Part 160 and Part 164, Subparts A and C).
      • Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal advice or an official regulatory determination. For specific guidance regarding your organization’s unique operational workflows, consult directly with a HIPAA compliance specialist or legal counsel.

    • Does HIPAA Prohibit the Use of Patient Sign-In Sheets?

      A common misconception among medical practices, dental clinics, and physical therapy centers is that the HIPAA Privacy Rule completely outlaws physical or digital patient sign-in sheets.

      It does not.

      The U.S. Department of Health and Human Services (HHS) explicitly permits the use of patient sign-in sheets. However, they are classified under the “incidental disclosure” doctrine. This means that while a sign-in sheet is a permissible administrative tool, its usage is legal only if your practice implements reasonable physical and administrative safeguards to limit the exposure of Protected Health Information (PHI).

      Leaving a highly detailed running list of patient data exposed on a clipboard at the front desk is a compliance failure that invites complaints, OCR scrutiny, and potential penalties.

      The Core Rule: What Can (and Cannot) Be Visible

      Under the HIPAA Privacy Rule, a sign-in sheet cannot serve as a clinical history log. Other patients standing at the front desk should only see the bare minimum required to check someone in.

      Permissible Information on a Sign-In Sheet

      Under the HIPAA Privacy Rule, a sign-in sheet is allowed to capture the bare minimum required for basic administrative check-in. It is completely acceptable to ask for the patient’s name, their arrival time, and the name of the specific doctor or provider they are scheduled to see.

      Strictly Prohibited Data (HIPAA Violations)

      The line is crossed when a sign-in sheet begins to act as a clinical history log. To avoid a compliance violation, a sign-in sheet must never display the reason for the visit or medical symptoms, any medical conditions or diagnoses, insurance provider details, or sensitive personal identifiers like a Social Security Number or Date of Birth.

      The Red Line: A patient standing at the counter should never be able to look at the sheet and deduce why the person before them is visiting the clinic. Writing “John Doe — 10:00 AM” is acceptable. Writing “John Doe — 10:00 AM — Chest Pain” or “John Doe — Oncologist Dr. Smith” in a multi-specialty clinic crosses into non-compliant PHI exposure.

      Actionable Safeguards: Moving Beyond the Clipboard

      To ensure your sign-in process is legally defensible during a compliance review, your practice must implement operational controls. Relying on an open-face, continuous paper logbook is no longer a best practice.

      Implement these three physical and technical safeguards immediately:

      1. Peel-Off / Label Sign-In Sheets

      If your practice relies on paper, use a security sign-in sheet system featuring adhesive peel-off strips. When a patient signs in, the front desk receptionist peels off the strip containing the name and takes it to the back office. The next patient only sees a blank backing sheet, completely eliminating the risk of peer-to-peer data exposure.

      2. Physical Barrier Controls

      Position the sign-in area so it is entirely within the clear line of sight of your administrative staff, but shielded from waiting room occupants. Use privacy screens or desk geometry to ensure that patients standing in line cannot hover over or read the clipboard.

      3. Digital Intake Kiosks (Technical Safeguards)

      Many modern practices have shifted to tablets or digital kiosks. While an excellent alternative to paper, kiosks introduce technical safeguard requirements. Ensure that:

      • The screen automatically times out or clears after a brief period of inactivity.
      • Privacy filters are installed on the glass to prevent “shoulder surfing.”
      • The software does not display a rolling list of previously checked-in patients on the home screen.

      Workforce Compliance: Training the Front Desk

      Even the best physical safeguards fail without continuous workforce enforcement. Your administrative staff must understand that handling sign-in sheets requires active risk ownership.

      • Turn It Over: If utilizing a temporary paper sheet, staff must flip the clipboard face-down whenever they step away from the front desk.
      • Shred Daily: Once a paper sign-in sheet or the peeled backing strips have served their administrative purpose for the day, they must be disposed of in a locked shredding bin. They must never be thrown into a standard trash can.
      • Enforce Boundaries: Train front-desk personnel to gently instruct waiting patients to stand back behind a designated marker line until it is their turn to check in.

      Defend Your Process

      Using a patient sign-in sheet is an efficient workflow tool, but it requires deliberate management. Compliance fails when a practice treats day-to-day administrative routines as exempt from privacy standards.

      Is your front desk layout, digital intake process, or paper documentation protocol audit-ready? Colington Consulting provides operational, evidence-based compliance programs that protect your practice from penalties and risk.

      Schedule a 30-Minute HIPAA Risk Review and evaluate your clinic’s safeguards.

      • Reviewed By: Jay Hodes, President – Colington Consulting, HIPAA Compliance Expert
      • Regulatory Sources: U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) Guidance on “Incidental Uses and Disclosures” (45 CFR 164.502(a)(1)(iii)).
      • Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal advice or an official regulatory determination. For specific guidance regarding your organization’s unique operational workflows, consult directly with a HIPAA compliance specialist or legal counsel.

    • HIPAA Rules for Paper Records in 2026

      Reviewed by: Jay Hodes, President – Colington Consulting, HIPAA Compliance Expert

      While modern healthcare compliance heavily focuses on cybersecurity and electronic Protected Health Information (ePHI), physical security remains a critical vulnerability. The Department of Health and Human Services (HHS) and the Office for Civil Rights (OCR) continue to penalize organizations for failing to safeguard physical documents.

      Improperly handled paper records, such as files left on desks, unkeyed filing cabinets, or un-shredded documents thrown into standard recycling bins—account for a massive portion of easily avoidable HIPAA violations.

      Whether your team operates in a traditional clinic or a hybrid office environment, understanding your responsibility to safeguard paper records is essential to protecting patient privacy and avoiding costly penalties.

      What Does HIPAA Require for Paper Records?

      The HIPAA Security Rule primarily governs electronic data, but the HIPAA Privacy Rule strictly mandates that Covered Entities and Business Associates apply appropriate administrative, technical, and physical safeguards to protect PHI in any form, including paper.

      To remain compliant, your organization must ensure physical records are protected throughout their entire lifecycle: creation, storage, usage, and disposal.

      Core Safeguards for Physical Files:

      • The “Clean Desk” Principle: Employees must not leave documents containing PHI exposed on desks, counters, or workstations when they step away.
      • Dual-Lock Custody: Paper charts, intake forms, and billing statements should be stored behind locked doors and inside locked filing cabinets when not in active use.
      • Strict Access Controls: Access to file rooms should be restricted only to authorized personnel who require the information to perform their specific job duties.

      The Remote & Hybrid Work Blindspot

      The shift toward remote and hybrid work environments has introduced significant new risks for physical PHI. When administrative or billing staff work from home, the boundaries of your secure facility disappear.

      If your employees handle paper records remotely, your compliance policies must adapt:

      1. No Home Printing: Prohibit the printing of patient schedules, medical notes, or billing details on personal home printers unless explicitly authorized and monitored under a strict remote work agreement.
      2. Secure Home Storage: If paper PHI must be taken home, it cannot be left on kitchen counters or shared desks where family members or visitors can see it. It must be locked away.
      3. Prohibited Disposal: Employees must never discard paper PHI in home trash cans or residential recycling bins. Documents must either be brought back to the office for secure destruction or shredded at home using an approved cross-cut shredder.

      Proper Disposal: The “Shred-All” Solution

      The absolute highest risk associated with paper records occurs during disposal. Dumpster-diving incidents and accidental exposure of intact records are viewed severely by federal investigators.

      Under HIPAA, acceptable methods for destroying paper records include burning, pulverizing, melting, or shredding so that the PHI is rendered essentially unreadable and cannot be reconstructed.

      Implementing a “shred-all” policy across your organization removes the guesswork for your staff. If every document goes into a secure, locked shredding bin, the risk of a human error leading to a breach drops dramatically.

      Are Your Physical & Digital Safeguards Audit-Ready?

      Leaving paper records vulnerable is one of the fastest ways to fail a routine compliance check or trigger an OCR investigation. Don’t wait for an accidental exposure to discover the gaps in your practice’s physical security.

      Schedule your 30-Minute HIPAA Risk Review. Our experts will help you identify hidden vulnerabilities in your workflow and ensure your safeguards are completely defensible.

      Sources & Legal References:

      • U.S. Department of Health and Human Services (HHS)
      • Office for Civil Rights (OCR) 

      Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal or regulatory compliance advice. Reading this article does not establish a consulting relationship with Colington Consulting. For specific guidance regarding your organization’s unique HIPAA obligations, please consult directly with a compliance professional. 

    • Cybersecurity & HIPAA Compliance: Ransomware Enforcement Cases

      How Ransomware Is Driving OCR Enforcement

      What is the connection between cybersecurity and HIPAA?

      Cybersecurity is a core requirement of HIPAA compliance. The HIPAA Security Rule mandates that healthcare organizations implement administrative, technical, and physical safeguards to protect electronic protected health information (ePHI).

      As ransomware attacks increase, regulators now treat weak cybersecurity controls as direct HIPAA violations, not just IT failures.

      Why is ransomware increasing HIPAA enforcement?

      Ransomware incidents often expose gaps in compliance programs. When attackers encrypt or steal ePHI, the Office for Civil Rights (OCR)investigates whether the organization:

      • Conducted a risk analysis
      • Implemented access controls
      • Maintained system security and patching
      • Documented safeguards

      If these are missing, fines and settlements are likely, even if the attack itself was external.

      How Ransomware Is Reshaping HIPAA Compliance

      Ransomware has made healthcare one of the most targeted sectors for cyberattacks. As a result, HIPAA compliance now requires continuous cybersecurity risk management, not just annual documentation.

      OCR enforcement trends show that organizations are penalized most often for:

      • Failure to perform a risk analysis
      • Lack of multi-factor authentication (MFA)
      • Unpatched systems or outdated software
      • Insufficient audit controls and monitoring

      These findings confirm that cybersecurity weaknesses directly translate into HIPAA Security Rule violations.

      OCR Enforcement Examples and Common Violations

      1. Lack of Risk Analysis

      OCR consistently identifies missing or incomplete risk assessments as a top violation. Organizations must demonstrate they actively identify and mitigate risks.

      What is a Security Risk Assessment?

      A proper risk analysis is not optional—it is the foundation of HIPAA compliance.

      2. Weak Access Controls

      Ransomware attackers commonly exploit poor authentication and user access management. OCR frequently cites:

      • No MFA
      • Shared logins
      • Excessive user privileges

      3. Inadequate System Security

      Failure to patch systems or monitor networks allows ransomware to spread quickly. OCR expects proactive vulnerability management and real-time detection.

      What Cybersecurity Measures Are Required for HIPAA Compliance?

      To meet modern HIPAA expectations, healthcare organizations should implement:

      • Enterprise-wide risk assessments
      • Endpoint detection and response (EDR)
      • Secure, tested backups
      • Email security and phishing prevention
      • Continuous monitoring and audit logging
      • Workforce security training

      These safeguards must be documented and regularly updated.

      How to Align Cybersecurity with HIPAA Requirements

      Organizations must move from reactive compliance to integrated security programs.

      At Colington Consulting we help healthcare organizations align cybersecurity with HIPAA requirements.

      What services are needed to meet HIPAA requirements?

      Our approach combines regulatory expertise with real-world threat protection, reducing both breach risk and enforcement exposure. For additional guidance, visit our HIPAA compliance blog page.

      Key Takeaways

      • Cybersecurity failures are now HIPAA violations
      • Ransomware drives increased OCR enforcement actions
      • Risk analysis is the most commonly cited deficiency
      • Organizations must implement proactive, continuous security controls
      • Compliance now requires operational cybersecurity, not just policies

      FAQ

      Are ransomware-related HIPAA breaches made public by OCR?

      Yes. As required by the HITECH Act, OCR posts on the HHS website a list of breaches of unsecured protected health information affecting 500 or more individuals.

      What is the most common HIPAA violation in ransomware cases?

      Failure to conduct a comprehensive risk analysis is the most frequent violation cited by OCR.

      Does HIPAA require cybersecurity frameworks like NIST?

      HIPAA does not mandate NIST, but OCR expects organizations to follow recognized security standards to meet compliance requirements.

      Schedule a 30 minute HIPAA Risk Review

    • HIPAA Security Rule Policies And Procedures: Complete Guide

      Most organizations know they need HIPAA Security Rule policies and procedures. Fewer know what that actually means in practice. The Security Rule requires covered entities and business associates to document how they protect electronic protected health information (ePHI), not in vague terms, but through specific, implementable policies that address administrative, physical, and technical safeguards. Getting this wrong isn’t a minor oversight. It’s the single most common finding in OCR enforcement actions.

      The challenge is that the Security Rule is deliberately flexible. It tells you what to address but leaves how largely up to you. That flexibility is a feature for organizations that understand their risk environment, and a trap for those that don’t. Without clear guidance, many healthcare organizations either over-engineer policies they can’t maintain or adopt generic templates that fall apart under scrutiny. Neither approach produces a defensible compliance program.

      At Colington Consulting, we’ve helped hundreds of organizations build HIPAA compliance programs that hold up when it matters, during audits, breach investigations, and enforcement actions. This guide breaks down what the Security Rule actually requires for your policies and procedures, how to structure them, and what separates documentation that checks a box from documentation that protects your organization. Whether you’re building from scratch or overhauling an outdated program, you’ll walk away with a clear framework for implementation.

      Why HIPAA security rule policies and procedures matter

      When the Office for Civil Rights (OCR) investigates a breach or complaint, documented policies and procedures are among the first things auditors request. Your organization needs to show not just that a policy existed, but that it was in place before the incident, that workforce members received training on it, and that your team actually followed it. Without that paper trail, organizations with otherwise solid security controls still face significant penalties. The Security Rule exists to make ePHI protection systematic and verifiable, and your policies are the mechanism that proves you’ve done the work.

      Documentation is what OCR actually audits

      OCR’s enforcement investigations rely heavily on written documentation review. When auditors arrive, they request your policies, your risk analysis, your training records, and your sanction logs. If those documents don’t exist, or if they don’t reflect what your staff actually does day-to-day, that gap becomes a formal finding. Organizations frequently lose enforcement cases not because their security controls were technically inadequate, but because they couldn’t demonstrate those controls existed in writing. Your policies aren’t just internal guidance; they function as legal evidence of your compliance posture at any given point in time.

      OCR has cited missing or inadequate security policies as a contributing factor in enforcement actions even in cases where no breach actually exposed patient data.

      The financial stakes are concrete and growing

      OCR has collected over $150 million in HIPAA settlements and civil monetary penalties since enforcement began. Fines vary by violation tier, reaching up to $73,111(inflation adjusted) per violation for willful neglect that goes uncorrected. But your financial exposure doesn’t stop with OCR. Cyber insurers now routinely require documented HIPAA security policies as a condition of coverage, and many carriers deny claims when your documentation fails to demonstrate that reasonable safeguards were in place before a breach. A missing or outdated policy can cost your organization both the regulatory penalty and the insurance payout simultaneously.

      Beyond insurance, business associate agreements and contract requirements from health systems and payers increasingly include HIPAA compliance documentation as a contractual obligation. If you can’t produce current policies during a vendor audit, you risk losing those contracts entirely.

      Policies create a clear, consistent standard for your workforce

      Your staff cannot follow rules they don’t know exist. HIPAA security rule policies and procedures translate abstract regulatory language into specific, actionable instructions for the people who handle ePHI every day. A workstation use policy tells employees exactly what they can and cannot do on devices that access patient records. An access management policy tells your IT team precisely how to provision and revoke user credentials when roles change or employees leave. Without written standards, every person makes independent judgment calls, and your security posture depends entirely on individual behavior rather than organizational control.

      Written policies also reduce liability for your leadership team. When a workforce member follows a documented procedure and an incident still occurs, your organization can demonstrate reasonable diligence to regulators and insurers. When no procedure exists, both the organization and individual executives face significantly greater personal exposure. Sound documentation protects your staff and your leadership, not just your patients.

      Who must follow the HIPAA Security Rule

      The Security Rule applies to two broad categories of organizations under HIPAA: covered entities and business associates or referred to as regulated entities. If your organization falls into either group and handles electronic protected health information in any form, you are legally required to have HIPAA Security Rule policies and procedures in place. There is no minimum size threshold. A solo medical practice carries the same core compliance obligations as a large hospital system.

      Covered entities

      Covered entities are healthcare providers, health plans, and healthcare clearinghouses that transmit health information electronically in connection with standard transactions. This includes physicians, dentists, hospitals, outpatient clinics, health insurers, and Medicare/Medicaid programs. If your organization sends electronic claims, checks eligibility, or transmits any other standard healthcare transaction, you qualify as a covered entity regardless of how small your practice is.

      Many small practices mistakenly assume they fall below the regulatory threshold. OCR has enforced HIPAA against solo practitioners and small group practices in numerous documented cases.

      Size and patient volume do not affect your status as a covered entity. A two-physician practice that submits electronic claims to a single insurer has the same obligation to maintain written security policies as a 500-bed hospital. The Security Rule does allow smaller organizations to scale the complexity of their policies to match their risk environment, but it does not exempt them from having those policies at all.

      Business associates

      Business associates are vendors, contractors, and service providers that create, receive, maintain, or transmit ePHI on behalf of a covered entity. This category is broad and includes medical billing companies, IT managed service providers, cloud storage vendors, EHR software companies, and third-party transcription services. If your company touches patient data while performing a service for a healthcare organization, you are a business associate under HIPAA.

      Your business associate agreement (BAA) with a covered entity does not substitute for your own internal compliance program. You still need written security policies that meet the Security Rule’s requirements. If OCR investigates a breach that originates from your systems, your policies, not your BAA, will determine your exposure.

      What HIPAA requires for security policies and procedures

      The Security Rule organizes its requirements around three safeguard categories: administrative, physical, and technical. Within each category, individual standards contain specific implementation specifications. Your HIPAA Security Rule policies and procedures must address every applicable standard, but the rule gives you two types of specifications to work with, and understanding the difference directly affects how you write and structure your documentation.

      Required vs. addressable specifications

      Required specifications are non-negotiable. You must implement them as written, and your policies must reflect that you’ve done so. Addressable specifications carry more flexibility, but they are not optional. For each addressable specification, you must either implement it as described, implement an equivalent alternative, or document why it does not apply to your organization based on your risk analysis.

      Many organizations treat “addressable” as a synonym for “optional.” It is not. Failing to document your decision on an addressable specification is itself a compliance gap.

      Your policies need to capture the outcome of each of these decisions in writing. If you implemented multi-factor authentication as an alternative to a specification’s default control, your policy should state what you implemented and why that choice is appropriate for your risk environment.

      Documentation requirements

      Beyond the content of your policies, the Security Rule specifies how long you must retain your documentation. You are required to keep written policies, procedures, and related records for six years from the date of creation or the date they were last in effect, whichever is later. This means you cannot simply replace an outdated policy without retaining the prior version.

      Your documentation also needs to reflect changes in your organization over time. When you update a workflow, adopt a new system, or change workforce roles that affect ePHI access, your policies must be reviewed and revised accordingly. Static documentation that no longer matches how your organization actually operates creates significant risk during an OCR audit, because auditors compare your written procedures against your actual operational practices, and gaps between the two become formal findings.

      Administrative safeguard policies and procedures

      Administrative safeguards represent the largest and most foundational category of the HIPAA Security Rule. These are the management-level controls that govern how your organization identifies risk, trains staff, manages access, and responds when things go wrong. Your HIPAA Security Rule policies and procedures for administrative safeguards set the foundation that every other safeguard category builds on. Without them, your physical and technical controls have no governance structure supporting them.

      Security Management Process

      Your security management process policies need to document how your organization identifies, analyzes, and responds to risks to ePHI. This standard includes four required implementation specifications: risk analysis, risk management, sanction policy, and information system activity review. Each one requires a written policy explaining what your organization does, how often it does it, and who is responsible.

      Your risk analysis is not a one-time event. OCR expects documented evidence that you repeat this process when your environment changes, such as when you adopt new technology or experience a workforce restructuring.

      Your sanction policy is one of the most frequently overlooked elements in this category. It must specify the consequences your organization applies when workforce members violate your security policies. Without a written sanction policy, you cannot demonstrate to OCR that you hold your staff accountable, which becomes a significant problem during breach investigations.

      Workforce and Access Management

      Access management policies cover who gets access to ePHI, under what conditions, and how that access gets removed. Your authorization and supervision policies should define the process your organization uses to grant access based on job function, not individual preference. When employees change roles or leave the organization, your policies need to specify the exact steps for modifying or terminating their access and the timeframe in which those steps must be completed.

      Your workforce training policies fall under this category as well. These policies must describe how you deliver security awareness training, how you track completion, and how often you refresh that training. Training records tied directly to your written policies give you the documentation trail that OCR auditors look for when evaluating whether your administrative safeguards function as a real program rather than a set of documents stored in a drawer.

      Physical safeguard policies and procedures

      Physical safeguards govern how your organization controls access to the physical spaces and devices that store or process ePHI. Most organizations underestimate this category because it feels less technical than firewalls or encryption, but OCR takes physical access controls seriously. Your HIPAA Security Rule policies and procedures for this category need to address your facilities, your workstations, and every device that touches patient data, including laptops, mobile devices, and workstations in shared clinical areas.

      Facility Access and Control

      Your facility access policies must define who can enter areas where ePHI systems are housed and how your organization documents, monitors, and restricts that access. This includes server rooms, records storage areas, and any space where unattended workstations could give an unauthorized person access to patient data. Your policies should specify the physical controls you use, such as key cards, locks, or visitor logs, and assign clear accountability for maintaining and reviewing those controls.

      Physical access events that go undocumented create a compliance gap that OCR investigators can use to establish a pattern of insufficient safeguards, even when no breach occurred.

      Your contingency access procedures also belong in this category. When your normal access controls fail during an emergency, your staff needs a written protocol for maintaining facility security while still allowing appropriate personnel to reach critical systems. Document that protocol explicitly so it is available and tested before an incident requires it.

      Workstation and Device Controls

      Workstation use policies must define what employees are permitted to do on devices that access ePHI and what physical environment those workstations should be in. Screens that face public waiting areas, unlocked devices left unattended, and shared login credentials are all physical security failures that belong in your policy documentation. Your workstation security policy should describe the physical positioning, screen lock requirements, and access restrictions that apply to every ePHI-capable device in your environment.

      Device and media controls extend this to hardware that moves in and out of your organization. Your policies need to address how you track, transfer, and dispose of devices that store ePHI, including the steps required before any hardware leaves your control through reassignment, repair, or destruction.

      Technical safeguard policies and procedures

      Technical safeguards define the technology-based controls your organization uses to protect ePHI at rest and in transit. Your HIPAA Security Rule policies and procedures for this category need to cover how your systems restrict access, generate audit logs, protect data integrity, and secure transmissions. These policies must reflect the actual technology your organization uses, not generic descriptions of controls that don’t match your environment.

      Access Controls and Audit Controls

      Your access control policies must specify how your systems limit ePHI access to authorized users only and what technical mechanisms enforce those limits. This includes unique user identification requirements, emergency access procedures, automatic logoff settings, and encryption or decryption protocols. Each of these elements needs its own policy language that assigns responsibility and defines the technical standard your organization meets.

      A policy that simply states “we control access to ePHI” gives OCR auditors nothing to work with. Your documentation needs to name the specific controls in place and explain how they function within your environment.

      Your audit control policies address how your organization captures and reviews activity logs across systems that contain ePHI. You need written procedures that describe which systems generate logs, what those logs capture, how long you retain them, and who reviews them and at what frequency. Without a documented review process, your logs become a liability rather than an asset because you collect evidence of potential violations without any mechanism to detect or respond to them.

      Transmission Security and Integrity Controls

      Transmission security policies must define how your organization protects ePHI when it moves across networks, including email, patient portals, file transfers, and API connections. Your policies should identify the encryption standards your organization applies and specify which transmission types require those controls. Staff need clear written guidance on which channels are approved for sending ePHI and which are prohibited.

      Integrity controls belong alongside your transmission policies. These procedures describe how your organization detects whether ePHI has been altered or destroyed without authorization, both in storage and during transmission. Document the specific mechanisms your systems use and assign a responsible party for monitoring and responding to integrity alerts.

      Final takeaways

      HIPAA Security Rule policies and procedures are not a compliance checkbox. They are the documented foundation that determines whether your organization can defend itself when OCR comes knocking, when a breach triggers an investigation, or when a cyber insurer reviews your claim. Every administrative, physical, and technical safeguard your organization implements needs written policies that reflect how your systems actually operate, who owns each control, and what happens when something goes wrong.

      Generic templates and one-time documentation projects leave you exposed. Your policies need to evolve as your organization changes, and they need to be enforced through training, sanction procedures, and regular review. The gap between having a policy and having a defensible compliance program is exactly where most organizations fail.

      If you want to build a compliance program that holds up under scrutiny, work with a HIPAA compliance consulting firm that takes ownership of the process alongside you.

      Schedule a 30 minute HIPAA Risk Review