logo
Contact Us

844-740-7100

    Colington Consulting

    Helping Organizations Achieve HIPAA Compliance™

    Contact Us

    Category: HIPAA Enforcement

    • OCR Fined a Health System $800,000 for Ransomware, Then Published the Fix the Next Day

      OCR Fined a Health System $800,000 for Ransomware, Then Published the Fix the Next Day

      Why Did Lehigh Valley Health Network Pay $800,000, and What Does OCR Expect?

      Quick answer: OCR found that Lehigh Valley Health Network (LVHN) failed to conduct an accurate, thorough risk analysis, did not regularly review information system activity, and notified patients and HHS late after a 2023 ransomware attack exposed the protected health information (PHI) of 248,359 individuals. OCR announced the $800,000 settlement on October 29, 2026. The next day, its October 2026 Cybersecurity Newsletter linked the Cybersecurity and Infrastructure Security Agency’s (CISA) essential steps, including phishing training, multifactor authentication (MFA), logging, backups, and encryption, directly to HIPAA Security Rule requirements. For every covered entity and business associate, the message is the same: these safeguards are already required, and OCR expects them in place before an attack, not after.

      What Happened at Lehigh Valley Health Network

      On February 4, 2023, LVHN, a Pennsylvania health system, detected suspicious activity in its IT system that was later confirmed to be ransomware. LVHN filed a breach report with HHS on May 15, 2023. Attackers exfiltrated PHI and posted it on the dark web; the compromised information included radiation oncology treatment photographs, names, addresses, dates of birth, Social Security numbers, driver’s license numbers, financial information, diagnoses, lab results, medications, and treatment information.

      Under the resolution agreement, LVHN paid $800,000 and agreed to a corrective action plan that OCR will monitor for three years. OCR identified the settlement as its 22nd ransomware enforcement action. OCR Director Paula M. Stannard summarized the agency’s position plainly: “The best defense against cyberattacks is full implementation of the HIPAA Security Rule.”

      What OCR Found

      OCR’s investigation began with LVHN’s breach report and found potential violations of the Privacy, Security, and Breach Notification Rules:

      • No accurate and thorough risk analysis of the potential risks and vulnerabilities to all of its electronic protected health information (ePHI).
      • No procedures to regularly review information system activity, such as audit logs, access reports, and security incident tracking reports.
      • An impermissible disclosure of the PHI of 248,359 individuals.
      • Late notification to affected individuals of a breach of unsecured PHI.
      • Late notification to the Secretary of HHS of the same breach.

      The corrective action plan requires a new risk analysis, a risk management plan, revised policies and procedures, and updated workforce training.

      Three Lessons From the Findings

      1. Enforcement has a long tail

      More than three and a half years passed between discovery of the attack and the settlement. The documentation you have today is what OCR will evaluate years from now; it cannot be rebuilt after the fact.

      2. Logging is only half the control

      The Security Rule separates audit controls, which record system activity, from information system activity review, which requires someone to examine it. OCR cited LVHN for the second. Logs nobody reads will not catch an intruder before data leaves the network.

      3. The breach notification clock does not wait for the investigation

      HIPAA requires notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery, and notice to HHS within the same window when 500 or more individuals are affected. LVHN’s breach report was filed more than three months after LVHN discovered the suspicious activity, and OCR cited late notice to both individuals and HHS as separate violations. A slow response adds violations on top of the breach itself.

      One Day Later, OCR Published the Roadmap

      OCR’s October 2026 Cybersecurity Newsletter, released for Cybersecurity Awareness Month under the theme “Securing the Next 250,” took the essential steps CISA recommends for critical infrastructure organizations, including the Healthcare and Public Health sector, and tied each one to a specific Security Rule requirement.

      Phishing training maps to security awareness and training; strong passwords and MFA map to person or entity authentication; software updates map to risk analysis and risk management; logging maps to audit controls and information system activity review; backups map to the data backup plan; encryption maps to the encryption specifications for data at rest and in transit; incident response plans map to security incident procedures; and preparing for system disruptions maps to the contingency plan. The one step HIPAA does not require is reporting cyber incidents to CISA, which OCR encourages but does not mandate.

      Where the Settlement and the Newsletter Point to the Same Gaps

      The risk analysis drives everything else. The newsletter ties authentication choices and patching priorities back to the risk analysis, and OCR’s recommendations in the LVHN announcement start with identifying how ePHI enters, flows through, and leaves your systems. Without an accurate and thorough risk analysis, no other security decision is defensible.

      System activity review is a recurring enforcement theme. It is a finding in the LVHN settlement and a core step in the newsletter. If you cannot show who reviews logs, how often, and what happens next, OCR will find that gap.

      Backups must survive the attack. Because some ransomware deletes or disrupts online backups, OCR advises keeping at least some backups offline, reviewing backup logs, and periodically testing restorations.

      Addressable does not mean optional. ePHI must be encrypted at rest and in transit wherever reasonable and appropriate; where it is not, the organization must implement an equivalent alternative, if reasonable and appropriate, and document its rationale.

      Reporting to CISA is not HIPAA breach reporting. A CISA report does not satisfy HIPAA breach notification; individuals, HHS, and, where required, the media must still be notified.

      What to Do Before OCR Asks

      • Complete or update a risk analysis that traces ePHI where it enters, flows through, and leaves every system, vendor, and location.
      • Build a risk management plan that assigns an owner, a safeguard, and a target date to each identified risk.
      • Assign responsibility for regular log and access report review, and document each review.
      • Confirm backups include offline copies, and keep records of successful restoration tests.
      • Document your encryption decisions for ePHI at rest and in transit, including any equivalent alternatives.
      • Base authentication decisions, including where MFA is required, on your risk analysis.
      • Rehearse your incident response plan at least annually with leadership, legal counsel, and technical staff, and confirm it meets HIPAA’s 60 day breach notification deadline.
      • Train every workforce member, including management, on phishing and their role specific responsibilities.

      Frequently Asked Questions

      What was the Lehigh Valley Health Network HIPAA settlement?

      On October 29, 2026, OCR announced that LVHN paid $800,000 and agreed to a corrective action plan monitored for three years, resolving an investigation into a 2023 ransomware attack that affected 248,359 individuals. It was OCR’s 22nd ransomware enforcement action.

      Why would OCR penalize an organization that was the victim of a ransomware attack?

      OCR does not penalize the attack itself; it penalizes the compliance failures uncovered by the investigation. At LVHN, those included a lack of an accurate and thorough risk analysis, no regular review of information system activity, and late breach notification.

      Does HIPAA require multifactor authentication?

      The Security Rule does not prescribe a specific authentication method, but it requires procedures to verify that anyone seeking access to ePHI is who they claim to be. OCR’s October 2026 newsletter explains that the risk analysis should guide the choice and that MFA may be needed to reduce risk for remote access and more sensitive systems.

      Is encryption required under HIPAA?

      Encryption is an addressable specification, meaning regulated entities must encrypt ePHI at rest and in transit wherever reasonable and appropriate. If encryption is not reasonable and appropriate in a specific circumstance, the organization must implement an equivalent alternative measure, if reasonable and appropriate, and document its decision and rationale.

      Don’t Let Your Risk Analysis Become the Finding; Colington Consulting Can Help

      Ransomware settlements keep returning to the same core finding: a lack of accurate, thorough risk analysis. Colington Consulting’s lead consultants have personally conducted more than 1,000 HIPAA risk assessments. We map how ePHI is created, moves, and leaves your organization across every system, vendor, and location; we evaluate the safeguards OCR actively enforces, including system activity review, backup isolation and testing, encryption decisions, authentication, and incident response; and we deliver a documented risk management plan that holds up when OCR requests it.

      Get a free HIPAA Risk Review. We will show you where your organization stands against the findings in the LVHN settlement and the steps in OCR’s October 2026 newsletter, and where to focus first.

      Schedule Your Free HIPAA Risk Review →

      Sources

      U.S. Department of Health and Human Services, Office for Civil Rights, “HHS’ Office for Civil Rights Settles Ransomware Investigation of Lehigh Valley Health Network,” October 29, 2026.

      U.S. Department of Health and Human Services, Office for Civil Rights, October 2026 OCR Cybersecurity Newsletter, “Cybersecurity Awareness Month 2026,” October 30, 2026.

      U.S. Department of Health and Human Services, Office for Civil Rights, October 2022 Cybersecurity Newsletter, “HIPAA Security Rule Security Incident Procedures.”

      Cybersecurity and Infrastructure Security Agency, Cybersecurity Awareness Month Toolkit (2026), cisa.gov.

      45 C.F.R. § 164.308(a)(1), Security Management Process; § 164.308(a)(5), Security Awareness and Training; § 164.308(a)(6), Security Incident Procedures; § 164.308(a)(7), Contingency Plan.

      45 C.F.R. § 164.312(b), Audit Controls; § 164.312(d), Person or Entity Authentication; §§ 164.312(a)(2)(iv) and 164.312(e)(2)(ii), Encryption; § 164.306(d)(3), Addressable Implementation Specifications.

      45 C.F.R. §§ 164.400 through 164.414, Breach Notification Rule.

    • Cybersecurity & HIPAA Compliance: Ransomware Enforcement Cases

      How Ransomware Is Driving OCR Enforcement

      What is the connection between cybersecurity and HIPAA?

      Cybersecurity is a core requirement of HIPAA compliance. The HIPAA Security Rule mandates that healthcare organizations implement administrative, technical, and physical safeguards to protect electronic protected health information (ePHI).

      As ransomware attacks increase, regulators now treat weak cybersecurity controls as direct HIPAA violations, not just IT failures.

      Why is ransomware increasing HIPAA enforcement?

      Ransomware incidents often expose gaps in compliance programs. When attackers encrypt or steal ePHI, the Office for Civil Rights (OCR)investigates whether the organization:

      • Conducted a risk analysis
      • Implemented access controls
      • Maintained system security and patching
      • Documented safeguards

      If these are missing, fines and settlements are likely, even if the attack itself was external.

      How Ransomware Is Reshaping HIPAA Compliance

      Ransomware has made healthcare one of the most targeted sectors for cyberattacks. As a result, HIPAA compliance now requires continuous cybersecurity risk management, not just annual documentation.

      OCR enforcement trends show that organizations are penalized most often for:

      • Failure to perform a risk analysis
      • Lack of multi-factor authentication (MFA)
      • Unpatched systems or outdated software
      • Insufficient audit controls and monitoring

      These findings confirm that cybersecurity weaknesses directly translate into HIPAA Security Rule violations.

      OCR Enforcement Examples and Common Violations

      1. Lack of Risk Analysis

      OCR consistently identifies missing or incomplete risk assessments as a top violation. Organizations must demonstrate they actively identify and mitigate risks.

      What is a Security Risk Assessment?

      A proper risk analysis is not optional—it is the foundation of HIPAA compliance.

      2. Weak Access Controls

      Ransomware attackers commonly exploit poor authentication and user access management. OCR frequently cites:

      • No MFA
      • Shared logins
      • Excessive user privileges

      3. Inadequate System Security

      Failure to patch systems or monitor networks allows ransomware to spread quickly. OCR expects proactive vulnerability management and real-time detection.

      What Cybersecurity Measures Are Required for HIPAA Compliance?

      To meet modern HIPAA expectations, healthcare organizations should implement:

      • Enterprise-wide risk assessments
      • Endpoint detection and response (EDR)
      • Secure, tested backups
      • Email security and phishing prevention
      • Continuous monitoring and audit logging
      • Workforce security training

      These safeguards must be documented and regularly updated.

      How to Align Cybersecurity with HIPAA Requirements

      Organizations must move from reactive compliance to integrated security programs.

      At Colington Consulting we help healthcare organizations align cybersecurity with HIPAA requirements.

      What services are needed to meet HIPAA requirements?

      Our approach combines regulatory expertise with real-world threat protection, reducing both breach risk and enforcement exposure. For additional guidance, visit our HIPAA compliance blog page.

      Key Takeaways

      • Cybersecurity failures are now HIPAA violations
      • Ransomware drives increased OCR enforcement actions
      • Risk analysis is the most commonly cited deficiency
      • Organizations must implement proactive, continuous security controls
      • Compliance now requires operational cybersecurity, not just policies

      FAQ

      Are ransomware-related HIPAA breaches made public by OCR?

      Yes. As required by the HITECH Act, OCR posts on the HHS website a list of breaches of unsecured protected health information affecting 500 or more individuals.

      What is the most common HIPAA violation in ransomware cases?

      Failure to conduct a comprehensive risk analysis is the most frequent violation cited by OCR.

      Does HIPAA require cybersecurity frameworks like NIST?

      HIPAA does not mandate NIST, but OCR expects organizations to follow recognized security standards to meet compliance requirements.

      Schedule a 30 minute HIPAA Risk Review

    • 2025 HIPAA Enforcement Trends So Far: What To Know

      2025 HIPAA Enforcement Trends So Far: What Healthcare Providers Need to Know

      As we enter the month of October, healthcare compliance has faced a new level of scrutiny so far this year. The HHS Office for Civil Rights (OCR), the agency responsible for enforcing HIPAA, is no longer focusing only on isolated breaches. Instead, enforcement is targeting systemic gaps in security and compliance programs, particularly in areas where healthcare providers continue to fall short.

      Risk Analysis Remain the Cornerstone

      OCR has made it clear that a comprehensive, documented security risk analysis (SRA) remains the foundation of HIPAA compliance. Organizations that fail to conduct and regularly update an SRA put themselves at serious enforcement risk. Regulators expect healthcare practices to not only identify vulnerabilities but also take measurable steps to address them. Outdated or incomplete assessments are one of the most common triggers for enforcement actions.

      Ransomware is Now a Compliance Issue

      The dramatic rise in ransomware has changed the enforcement landscape. A cyberattack is no longer viewed as an isolated IT issue — it is now a compliance problem. If inadequate patching, lack of encryption, or a weak incident response plan contribute to a ransomware event, OCR is likely to pursue penalties or corrective action. Healthcare organizations must view ransomware preparedness as both a cybersecurity and a regulatory obligation.

      Modernization of the Security Rule

      HIPAA itself is evolving. Proposed updates to the Security Rule reflect the realities of today’s threat environment. Multi-factor authentication, encryption, vendor oversight, and formal incident response planning are poised to become explicit requirements rather than best practices. Providers who move early to implement these safeguards will be better positioned to demonstrate compliance when enforcement follows.

      Ongoing Right of Access Enforcement

      OCR’s Right of Access Initiative continues to be one of the agency’s most active enforcement areas. Patients must be able to access their records quickly and affordably. Practices that delay, overcharge, or fail to provide access face growing regulatory risk. In addition, business associates and third-party vendors are under greater scrutiny as regulators focus on the entire chain of responsibility for protected health information (PHI).

      Overlapping Compliance Pressures

      HIPAA is no longer the only regulatory concern. Telehealth, digital marketing, and state-level privacy laws are creating overlapping obligations. OCR and state attorneys general are increasingly aligned, making it essential for providers to understand and address compliance at both federal and state levels.

      Looking into the Crystal Ball for 2026

      The message from regulators is clear: compliance must be proactive, measurable, and ongoing. Organizations should:

      • Perform and document accurate and thorough security risk analysis.
      • Implement multi-factor authentication and encryption across systems.
      • Ensure Business Associate Agreements are in place, as appropriate for vendors.
      • Maintain and test an incident response plan.
      • Ensure all patients’ right-of-access requests are handled promptly.

      At the end of the day, OCR is rewarding organizations that can prove their compliance efforts are more than policies on paper. Demonstrable action is the key to avoiding costly enforcement.

      Colington Consulting | HIPAA Compliance, Risk Assessment & Management

      Is your organization ready for HIPAA enforcement? Contact our office today to schedule a free HIPAA compliance review and take the first step toward protecting your organization from regulatory risk.

      Helping Organizations Achieve HIPAA Compliance™

    • Anthem HIPAA Breach

      Setting the Stage for More Government Oversight

      by Jay Hodes, President – Colington Consulting

      The dust has settled, and more facts have been coming to light regarding the recent HIPAA data breach at Anthem Blue Cross Blue Shield. It was only a matter of time before the U.S. Congress started making some noise about cybersecurity. Within days of news reports of the Anthem breach, the U.S. Senate Committee on Health, Education, Labor and Pensions announced a bipartisan initiative to focus on the security of health information technology. This initiative will also look at the health industry’s overall preparedness for cyber threats.

      Although the timing was ironic and clearly not related to the Anthem breach, the White House announced its 2016 proposed budget that includes an increase in funding for HIPAA compliance programs. The proposed budget indicates around a 10% percent increase in funding for the Office for Civil Rights (OCR). OCR is the agency within the U.S. Department of Health and Human Services (HHS) with HIPAA compliance and oversight responsibilities.

      As far as the possible budget increase for OCR, we will wait to see what type of mood Congress is in to approve this. And, even with this congressional initiative, any proposed fixes will take time and money. In the meantime, hopefully the Anthem case sends a loud and clear message to all healthcare providers to up their game when it comes to protecting patient health information. Healthcare providers, plans and clearinghouses need to go on the offensive and be proactive when it comes to having the proper information technology safeguards in place. The threat of Congressional action or a beefed up OCR must not be the incentive to do so.

      Regrettably, the use of encryption is not a requirement of the HIPAA Security Rule. As shocking as that sounds, that does not mean covered entities do not need to encrypt their patient data. What the guidelines call for, as provided by HHS, is this:

      The encryption implementation specification is addressable, and must therefore be implemented if, after a risk assessment, the entity has determined that the specification is a reasonable and appropriate safeguard in its risk management of the confidentiality, integrity and availability of e-PHI [electronic protected health information]. If the entity decides that the addressable implementation specification is not reasonable and appropriate, it must document that determination and implement an equivalent alternative measure, presuming that the alternative is reasonable and appropriate. If the standard can otherwise be met, the covered entity may choose to not implement the implementation specification or any equivalent alternative measure and document the rationale for this decision.

      It is incumbent on covered entities to conduct a HIPAA Risk Assessment in order to make the determination on whether it is reasonable and appropriate to their particular circumstance to use encryption software. The assessment must be the basis for the decision. And if the decision is made not to encrypt, then the justification must be made abundantly clear in documentation.

      So if there is a breach and OCR asks during an investigation why your organization did not encrypt its protected health information, the justification must be based on a low threat to your data. Make sure you can back that up with documentation that is solid and well-defined. Possible civil and criminal prosecution will be based on the proof you provide.

      Need Help with Your HIPAA Compliance Program?

      At Colington Consulting, we specialize in helping healthcare organizations and business associates build proactive compliance programs. Contact us at 844-740-7100 or schedule a free 30-minute HIPAA risk review to evaluate your current policies and protect your organization.

      • This article was updated on June 23, 2026 and reviewed By: Jay Hodes, President – Colington Consulting, HIPAA Compliance Expert
      • Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal advice or an official regulatory determination. For specific guidance regarding your organization’s unique operational workflows, consult directly with a HIPAA compliance specialist or legal counsel.

    • HIPAA Compliance – Waiting for the Other Shoe to Drop

      by Jay Hodes, President – Colington Consulting

      The expression “waiting for the other shoe to drop” appears to have originated in the early 1900’s and is often associated with the arrival of a seemingly inevitable event. I speculate we are at that point in terms of ramped up HIPAA compliance enforcement. The recent Anthem data breach shined a significant spotlight on how vulnerable health information technology can be without the proper safeguards in place.

      The Office for Civil Rights (OCR), the U.S. Department of Health and Human Services agency responsible for HIPAA oversight, has made a lot of noise about being more aggressive in enforcement of the regulations. You would think it is time for the proverbial other shoe to drop. But not so fast. With limited resources, there is only so much OCR can do. That needs to change. It will and probably soon.

      There is now, and has been for a while, a lot at stake in terms of making sure healthcare providers and business associates have safeguards in place to properly secure patients’ protected health information. If major healthcare plans like Anthem are not making sure they are meeting all the HIPAA required implementation specifications, what can be said for smaller healthcare providers?

      The Ponemon Institute recently released its “Fifth Annual Study on Medical Identity Theft.” Among the findings, the study discovered that “consumers expect healthcare providers to be proactive in preventing and detecting medical identity theft.” What was surprising is that “many respondents are not confident in the security practices of their healthcare provider.” Another interesting outcome of study was that “79 percent of respondents say it is important for healthcare providers to ensure the privacy of their health records,” and almost half of those respondents said “they would consider changing healthcare providers if their medical records were lost or stolen.”

      The results of the Ponemon study must be a wakeup call for healthcare providers. Can you afford to have half of your patients leave your practice if a breach occurs? As a healthcare provider, don’t be surprised if patients start asking about how you are securing their protected health information (PHI). With all the recent data breaches in retail stores like Target, Sony PSN and Home Depot, consumers realize the vulnerabilities associated with the use of credit cards. As these same consumers seek healthcare services, it will be only a matter of time before questions are asked about safeguarding PHI.

      As a healthcare provider or business associate, make sure you are doing everything you can to protect health information. It goes way beyond a checklist. A robust HIPAA compliance program must be in place, regardless of the size of your practice or business. If you cannot meet all the HIPAA requirements by doing it in-house, consider outsourcing this responsibility. Take the burden off the plate of your office or practice manager or designated HIPAA officer.

      There is still time before that other shoe drops.

      Need Help with Your HIPAA Compliance Program?

      At Colington Consulting, we specialize in helping healthcare organizations and business associates build proactive compliance programs. Contact us at 844-740-7100 or schedule a free 30-minute HIPAA risk review to evaluate your current policies and protect your organization.

    • What Comes Up, Must Go Down: Regulatory Trends and HIPAA

      Enforcement of HIPAA mandates by the HHS Office for Civil Rights (OCR) are more aggressive than ever before, “totaling $28.7 million from enforcement actions” in 2018, an increase of 22% from the last record total of $23.5 million in 2016.  According to an OCR press release, 2018 saw that office establish “an all-time record year” in HIPAA enforcement activity, settling “10 cases” and being “granted summary judgment in a case before an Administrative Law Judge.” One of these 10 cases was the watershed HIPAA settlement with Anthem, Inc. for $16 million.

      OCR Settlements* and Judgement** for 2018

      Jan – FileFax*  –  $100,000

      Jan – Fresenius Medical Care* – $3,500,000

      Jun – MD Anderson** – $4,348,000

      Aug  – Boston Medical Center*  –  $100,000

      Sep – Brigham & Women’s Hospital* – $384,000

      Sep – Mass. General Hospital* – $515,000

      Sep – Advanced Care Hospitalists* – $500,000

      Oct – Allergy Associates of Hartford* – $125,000

      Oct – Anthem, Inc* – $16,000,000

      Nov – Pagosa Springs* – $111,400

      Dec – Cottage Health* – $3,000,000

      Total – Settlements & Judgement:  $28,683,400

      While the current administration did and continues to tout a posture of deregulation, the reality on the ground for organizations that must comply with HIPAA is that OCR has only strengthened its enforcement mechanisms, showing very little tolerance for security and privacy breaches arising from:

      • The mismanagement, or lack of proper storage, transmission, or disposal of patient PHI and ePHI.
      • An incomplete or missing Business Associate Agreement (BAA) made with any and all vendors who might be considered a Business Associates (BA) under HIPAA.
      • Cyberattacks via successful email phishing attempts targeting not just Covered Entity (CE) workers or employees, but also workers or employees of any vendor affiliated with the  CE.
      • Incompatible or insufficient risk analysis and risk management processes on the part of the CE.

      Out of these 11 instances of verified HIPAA violations,

      • 6 CEs were found to have mismanaged or improperly stored, transmitted, or disposed of patient PHI and ePHI (Fresenius Medical Care North America, FileFax, Inc., MD Anderson, Allergy Associates of Hartford, Pagosa Springs, and Cottage Health)
      • 3 CEs did not have a BAA in place to manage vendors who are considered to be BAs under HIPAA (Advanced Care Hospitalists, Pagosa Springs, and Cottage Health)  
      • 1 CE experienced an email phishing cyber-attack (Anthem, Inc.) 
      • 4 CEs made PHI or patient privacy vulnerable by exposing the same via TV shows, interviews, or recordings (Allergy Associates of Hartford, Boston Medical Center, Brigham and Women’s Hospital, and Massachusetts General Hospital)
      • 4 CEs lacked HIPAA-mandated risk assessment, risk analysis, risk notification, or risk management protocols (Cottage Health, MD Anderson, Advanced Care Hospitalists, and Fresenius Medical Care North America)

      From this analysis, it can be ascertained that CEs and BAs can avoid facing settlements and judgements due to violations of the HIPAA Privacy Rule and the HIPAA Security Rule by instituting the following “golden rules” and ensuring their staff are fully trained in the same:

      • Do have robust and comprehensive plan to assess, identify, report, respond, and manage all security or privacy risks.
      • Do ensure a signed and completed BAA is on file for all BAs
      • Do have highly specific protocols in place governing the collection, storage, transmission, and disposal of patient PHI and ePHI.

      Best practices include annual and periodic training for their workforce, conducting the required security risk assessment in an ongoing/periodic manner, and internally enforcing HIPAA policies and procedures to cover the organization’s security management processes.

      Organizations, large and small, must be aware of the aggressive posture of enforcement and record settlement amounts under OCR and this current administration. My advice for any organization is to conduct a thorough evaluation of the current HIPAA compliance in place. Make sure all the requirements are covered.  If a compliance program is not is place, consider outsourcing and let a consultant do the heavy lifting. Often times, a consultant can get the program in place much quicker than relying on the organization’s internal staff.

      This blog was previously posted February 12, 2019

    Helping healthcare organizations navigate HIPAA requirements, reduce compliance risks, and protect sensitive health information.

    Quick Links

    Our Services

    Specialty Services

    Need Help?

    Facebook X-twitter Linkedin Youtube

    © 2026 Colington Consulting. All rights reserved.