Most HIPAA questions land in a few places: what counts as a breach, which vendors need a business associate agreement, and what the Privacy and Security Rules actually require. Start with these featured topics.
HIPAA breach notification: what counts as a breach, the risk assessment, and notifying individuals, HHS, and the media.
All in Breach Notification
When a HIPAA breach hits, delay costs money. Build your response team before you need it: a data privacy attorney first (to help protect the investigation under privilege), then forensic and IT consultants, media relations, and HR.
The HIPAA Security Rule: administrative, physical, and technical safeguards for ePHI, risk analysis, and security management.
All in Security
Five practical steps to protect electronic patient data: start with a complete risk assessment, plan for disasters with offsite backups, keep training your staff, weigh security before you buy, and bring every affected department along.
The HIPAA Privacy Rule: permitted uses and disclosures of PHI, patient rights, the minimum necessary standard, and notices of privacy practices.
All in Privacy
Not every vendor with potential access to PHI is a business associate. IT contractors, cleaning crews, and consultants can still expose you to HIPAA and state privacy violations. A three-part strategy to manage the risk: policies, due diligence, and the right confidentiality agreement.
Business associate obligations under HIPAA: BAAs, subcontractors, direct liability, and managing vendors that handle PHI.
All in Business Associates
Not every vendor with potential access to PHI is a business associate. IT contractors, cleaning crews, and consultants can still expose you to HIPAA and state privacy violations. A three-part strategy to manage the risk: policies, due diligence, and the right confidentiality agreement.
