Blog
HIPAA Security Rule Delay: Why You’re Not Off the Hook
Quick answer: HHS has pushed its target for finalizing the HIPAA Security Rule update from May 2026 to July 2027. But the delay only applies to the proposed new requirements— the current HIPAA Security Rule is still fully in effect, still enforced by OCR, and
Does Billing Medicaid Make Schools HIPAA Covered?
Schools Are Billing Medicaid for Behavioral Health Services — Does That Make Your District a HIPAA Covered Entity? Quick answer: In most cases, yes — technically. The moment your district (or a provider it employs) electronically bills Medicaid for a student’s mental health or behavioral
OCR Fined a Health System $800,000 for Ransomware, Then Published the Fix the Next Day
Why Did Lehigh Valley Health Network Pay $800,000, and What Does OCR Expect? Quick answer: OCR found that Lehigh Valley Health Network (LVHN) failed to conduct an accurate, thorough risk analysis, did not regularly review information system activity, and notified patients and HHS late after
5 HIPAA Compliance Gaps That Put Healthcare Organizations at Risk
Why Small Gaps Create Big Exposure HIPAA compliance failures rarely begin with a single dramatic mistake. More often, they stem from overlooked documentation, inconsistent staff practices, incomplete risk reviews, or security controls that have not kept pace with operational change. For healthcare providers and business
Why HIPAA Is Still Confusing After Thirty Years, Especially for Small and Midsize Providers
Quick answer: HIPAA has been federal law since 1996, yet small and midsize providers still get tripped up by it, and the reason is rarely carelessness. Most owners and office managers never received formal HIPAA training; they inherited assumptions from a prior job, a vendor’s marketing
Does Having an MSP Mean Your Practice Is HIPAA Compliant? Not on Its Own
Quick answer: No, and this is one of the most common and most understandable misconceptions in healthcare compliance. A skilled managed service provider, or MSP, can lock down your network, patch your systems, and manage backups better than most practices could on their own; if
