HIPAA and IT Security: What Most Teams Get Wrong

A Missing Firewall Rule Cost One Health System $5.5 Million

In 2017, Memorial Healthcare System paid $5.5 million to settle HIPAA violations with OCR. The root cause wasn't a sophisticated nation-state attack. It was login credentials that should have been deactivated years earlier. A former employee's credentials gave unauthorized access to the ePHI of 115,143 individuals.

That's the story of HIPAA and IT security in a single paragraph. The biggest breaches rarely come from exotic exploits. They come from the mundane stuff your IT team meant to fix last quarter.

I've spent years consulting with covered entities and business associates on exactly these failures. The pattern is remarkably consistent: organizations invest heavily in perimeter defenses while ignoring the internal gaps that OCR actually investigates. This post breaks down where those gaps live — and what you can do about them before an auditor or an attacker finds them first.

The Security Rule Isn't Optional — But Most Risk Analyses Treat It That Way

Every covered entity and business associate must comply with the HIPAA Security Rule. That's not news. What surprises people is how specific OCR gets when they examine your compliance.

The Security Rule requires three categories of safeguards: administrative, physical, and technical. Most IT teams jump straight to the technical — encryption, firewalls, intrusion detection. But OCR's enforcement history tells a different story. The single most cited deficiency in OCR settlements is the failure to conduct a comprehensive, organization-wide risk analysis.

Not a vulnerability scan. Not a penetration test. A genuine risk analysis that identifies every place ePHI lives, every threat to it, and every vulnerability that could be exploited. I've reviewed risk analyses from mid-sized hospital systems that completely omitted mobile devices, cloud storage, and biomedical equipment. Those aren't edge cases — they're where breaches actually happen.

What a Real Risk Analysis Looks Like

A compliant risk analysis under HIPAA and IT security standards must do four things:

Identify every system that creates, receives, maintains, or transmits ePHI — including AI tools, remote workstations, and third-party platforms.
Assess the likelihood and impact of each identified threat.
Document current security measures and their effectiveness.
Produce a risk management plan with specific remediation timelines.

If your last risk analysis was a checklist someone filled out in an afternoon, you don't have a risk analysis. You have a liability.

The $1.5 Million Gap Between "We Have Encryption" and Actually Encrypting ePHI

In 2018, Fresenius Medical Care North America agreed to a $3.5 million settlement after five separate breach incidents at different facilities. Among the findings: unencrypted laptops, missing device and media controls, and inconsistent policies across locations.

Encryption is what the Security Rule calls an "addressable" specification. Too many IT leaders read "addressable" as "optional." It's not. Addressable means you must implement the specification or document why an equivalent alternative is reasonable and appropriate. "We didn't get around to it" has never satisfied OCR.

Here's what I tell every IT director I work with: if a laptop with unencrypted ePHI gets stolen from a car, you have a reportable breach. If that same laptop was encrypted to NIST standards, it's not a breach under the Breach Notification Rule. Encryption literally determines whether you're making a phone call to your security officer or to HHS.

Remote Work Blew Open Every Assumption About ePHI Access

The shift to remote and hybrid work didn't just change where people sit. It changed the entire attack surface for healthcare organizations. Home Wi-Fi networks, shared family computers, voice assistants listening in the background — none of these existed in your original IT security plan.

I've seen pharmacies where staff access patient records from personal tablets over unsecured networks. I've seen therapy practices where clinicians conduct telehealth sessions from coffee shops. Every one of those scenarios is a potential HIPAA violation.

If your workforce accesses ePHI from home — and in 2026, almost every organization has at least some remote access — your policies need to address it explicitly. Our Working from Home & PHI training was built specifically for this scenario, covering the technical and behavioral controls your remote staff needs to understand.

Minimum Controls for Remote ePHI Access

VPN or zero-trust network access for all connections to systems containing ePHI.
Multi-factor authentication — not just passwords.
Automatic session timeouts and screen locks.
Prohibition on downloading ePHI to personal devices unless encrypted and managed.
Documented policies that remote workers sign and acknowledge annually.

AI Tools Are the Newest Threat Vector Your Security Team Isn't Tracking

Here's the scenario I keep encountering: a well-meaning clinician pastes a patient's lab results into a large language model to help draft a clinical summary. That ePHI just left your organization's control entirely. No BAA. No encryption in transit to a compliant endpoint. No audit trail.

AI adoption in healthcare is accelerating faster than policies can keep up. HIPAA and IT security programs that don't explicitly address AI tools are already behind. The Security Rule's requirements around access controls, audit controls, and transmission security all apply to AI platforms — but only if your workforce knows that.

This is exactly why we developed the Using AI Tools & PHI course. It gives your staff concrete rules for when and how AI can interact with protected health information — and when it absolutely cannot.

What Does OCR Actually Look for in an IT Security Investigation?

If you're wondering what triggers an OCR investigation and what they examine, the answer is straightforward. OCR opens investigations based on complaints, breach reports affecting 500 or more individuals, and periodic audits. Once they're in, they pull the thread on everything.

Here's what OCR consistently examines:

Risk analysis documentation. When was it last updated? Does it cover all systems?
Risk management plan. Did you actually remediate identified risks, or just document them?
Access controls. Who has access to ePHI, and is it limited to the minimum necessary?
Audit logs. Can you show who accessed what, when?
Workforce training records. Has every member of the workforce received HIPAA training? Can you prove it?
Business associate agreements. Are they current for every vendor that touches PHI?
Incident response procedures. Did you detect, respond, and report within regulatory timeframes?

That last point on workforce training is where I see the most embarrassing gaps. Organizations spend six figures on firewalls and then skip annual training for the humans who click phishing links. If your pharmacy staff hasn't completed role-specific training, our HIPAA & HITECH for Pharmacy Professionals course covers exactly the scenarios they face daily.

The Breach Notification Rule Has a 60-Day Clock — And It Starts Ticking Immediately

Under the Breach Notification Rule, covered entities must notify affected individuals within 60 days of discovering a breach of unsecured PHI. If 500 or more individuals are affected, you must also notify HHS and prominent media outlets simultaneously.

Your IT security incident response plan needs to account for this timeline. I've watched organizations burn 45 days on forensic investigation only to realize they have 15 days to draft notification letters, set up a call center, and brief leadership. That's not a plan. That's a crisis.

Build your breach response workflow backward from day 60. Know who makes the determination that a breach occurred. Know who drafts the notifications. Know who contacts HHS. Rehearse it annually.

Three Things to Do This Week

You don't need a six-month project to meaningfully improve your HIPAA and IT security posture. Start with these three actions:

Pull your last risk analysis. If it's older than 12 months or doesn't include remote work environments and AI tools, schedule an update immediately.
Audit your access controls. Run a report of every user account with access to ePHI. Deactivate anything that doesn't belong — former employees, expired vendor accounts, test accounts from 2019.
Verify workforce training completion. Check that every single workforce member — not just clinicians, but front desk staff, IT contractors, and billing teams — has completed HIPAA training this year. Browse our full training catalog if you need to fill gaps fast.

HIPAA and IT security isn't about achieving some theoretical state of perfect protection. It's about demonstrating that your organization takes reasonable, documented, ongoing steps to protect the people whose data you hold. OCR doesn't expect perfection. They expect effort, evidence, and accountability.

The organizations that get hit with seven-figure settlements aren't the ones who tried and fell short. They're the ones who never started.