A Single Unpatched Server Cost One Health System $3 Million

In 2018, the University of Texas MD Anderson Cancer Center lost its appeal of a $4.3 million penalty after OCR found that unencrypted devices containing ePHI had been stolen. The technology existed to prevent it. The policies existed on paper. But no one had enforced them where it mattered — at the IT infrastructure level.

That gap between policy and practice is exactly where HIPAA and IT security failures live. And in my experience consulting with covered entities and business associates, it's the most dangerous gap in healthcare today.

This post breaks down the real IT security requirements under HIPAA, the enforcement trends that should keep your CISO up at night, and the specific steps your organization needs to take before OCR comes knocking.

What HIPAA Actually Requires From Your IT Team

The HIPAA Security Rule — 45 CFR Part 160 and Part 164, Subparts A and C — applies specifically to electronic protected health information (ePHI). It lays out three categories of safeguards: administrative, physical, and technical. Your IT department owns significant pieces of all three.

Here's what trips up most organizations: the Security Rule is intentionally flexible. It doesn't say "use this firewall" or "deploy this encryption standard." It says you must assess your risks and implement measures that are reasonable and appropriate for your environment.

That flexibility is a trap for the unprepared. When OCR investigates a breach, they don't ask whether you bought expensive tools. They ask whether you conducted a thorough risk analysis and acted on the findings. If you can't show both steps, you're exposed.

The Technical Safeguards Most Teams Underestimate

Access controls, audit controls, integrity controls, and transmission security — those are the four technical safeguard standards in the Security Rule. Let me walk through where I see the biggest gaps.

  • Access controls: Too many organizations still share login credentials or fail to implement role-based access. Every workforce member should have a unique user ID, and your systems should enforce automatic logoff.
  • Audit controls: You need mechanisms that record and examine activity in systems containing ePHI. Having logs isn't enough — someone has to actually review them.
  • Integrity controls: Can you prove ePHI hasn't been improperly altered or destroyed? Most small practices can't.
  • Transmission security: If ePHI moves across a network, it needs encryption. Period. The rule lists encryption as "addressable," but ignoring it without a documented, justifiable alternative is reckless.

The $1.5 Million Fine That Proved Risk Analysis Isn't Optional

In 2017, OCR settled with CardioNet for $2.5 million after a stolen laptop exposed ePHI. The core finding? CardioNet had not conducted a thorough risk analysis at the time of the breach. Not a weak analysis. Not an outdated one. None at all.

I've walked into organizations that have spent six figures on security tools but never completed a proper risk analysis. That's like installing a state-of-the-art alarm system in a building with no locks on the doors.

The risk analysis is the foundation of HIPAA and IT security compliance. It must be comprehensive, documented, and updated regularly — not annually as a checkbox exercise, but whenever your environment changes. New EHR system? New cloud vendor? New remote work policy? Each one triggers a fresh assessment.

What Is the Relationship Between HIPAA and IT Security?

HIPAA doesn't replace your IT security framework — it sets a regulatory floor. The Security Rule requires covered entities and business associates to protect the confidentiality, integrity, and availability of ePHI through a combination of people, processes, and technology.

In practical terms, HIPAA and IT security intersect at every point where electronic health data is created, received, stored, or transmitted. Your firewalls, endpoint protection, encryption protocols, backup systems, access management tools, and incident response plans all fall under HIPAA's regulatory umbrella when they touch ePHI.

Think of HIPAA as the "why" and IT security as the "how." The Security Rule tells you what you must protect and the outcomes you must achieve. Your IT security program is the operational machinery that gets you there.

Remote Work Blew a Hole in Most Security Programs

The shift to remote and hybrid work didn't create new HIPAA requirements — but it exposed how many organizations had been skating by with perimeter-based security that assumed everyone was on-site.

Home networks, personal devices, shared workspaces, and consumer-grade routers became the new attack surface overnight. I've seen workforce members accessing ePHI over public Wi-Fi at coffee shops, storing patient data on personal laptops with no encryption, and using consumer messaging apps to discuss clinical information.

Every one of those scenarios is a potential HIPAA violation. If your organization supports remote work, your IT security policies must extend to every home office and every device that touches ePHI. Our Working from Home & PHI training course was built specifically for this scenario — because your workforce needs concrete guidance, not vague policy statements they'll never read.

AI Tools Are the Next IT Security Minefield

Here's the conversation I'm having with every client in 2026: what happens when your staff starts pasting patient information into AI chatbots, transcription tools, or clinical decision-support platforms?

Most AI tools operate on cloud infrastructure controlled by third parties. Unless you have a signed business associate agreement and have verified how the tool processes and stores data, feeding it ePHI is a breach waiting to happen.

The technology is moving faster than most compliance programs can adapt. That's exactly why we developed the Using AI Tools & PHI course — it gives your workforce a practical framework for evaluating AI tools before they use them, not after a breach investigation begins.

Shadow IT: The Threat You Can't Firewall Away

Shadow IT — unauthorized apps, tools, and services used by employees outside of IT's knowledge — is the fastest-growing HIPAA and IT security risk I encounter. A clinician downloads a scheduling app. A billing clerk uses a personal Dropbox. A nurse texts a photo of a wound to a colleague on an unsecured platform.

No amount of perimeter security stops a workforce member from making a bad decision. That's why workforce training isn't a soft compliance checkbox — it's a technical control. People are part of your security architecture whether you acknowledge it or not.

OCR has made its priorities clear. Between 2008 and 2024, HHS published over 130 resolution agreements and civil money penalties, and the most common root causes repeat like a drumbeat: incomplete risk analysis, lack of encryption, insufficient access controls, and failure to manage business associate agreements.

Notice a pattern? These are all IT security fundamentals. OCR isn't penalizing organizations for exotic threats. They're penalizing them for failing to do the basics — and document that they did them.

In 2023, OCR settled with Banner Health for $1.25 million after a 2016 hacking incident affected nearly 3 million individuals. The investigation revealed longstanding failures in access controls and security monitoring. The breach was sophisticated. The compliance failure was not.

Five Steps Your IT Team Should Take This Quarter

Stop treating HIPAA compliance as a once-a-year audit exercise. Here's what your IT leadership should prioritize right now:

  • Complete or update your risk analysis. Use the ONC Security Risk Assessment Tool if you need a starting point. Document everything.
  • Encrypt ePHI at rest and in transit. If you have a documented reason not to encrypt a specific system, that reason better be airtight and in writing.
  • Audit your access controls. Terminate access for former employees immediately. Review role-based access quarterly.
  • Inventory every tool that touches ePHI. That includes AI tools, cloud services, and anything your staff adopted on their own. If there's no BAA, there's a problem.
  • Train your workforce — with specificity. Generic annual training isn't enough. Your pharmacy team needs different training than your IT team. Our HIPAA & HITECH for Pharmacy Professionals course is one example of role-specific training that actually changes behavior.

Your IT Security Program Is Your Compliance Program

I've never seen an organization with a strong IT security program fail a HIPAA investigation. And I've never seen an organization with a weak one survive one unscathed.

HIPAA and IT security aren't parallel tracks. They're the same track. The Security Rule is an IT security regulation dressed in healthcare language. The sooner your organization treats it that way — with budget, executive support, and continuous workforce training — the sooner you stop being the next cautionary tale on OCR's wall of shame.

Your tools don't protect you. Your policies don't protect you. Your people, trained and equipped to make the right call when no one's watching — that's what protects you. Explore the full HIPAACertify training catalog to build a workforce that's ready.